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FOREWORD 


Internal auditing as a profession and as an aid to management has grown 
rapidly over a relatively few years. At the same time, it has changed 
substantially in nature, scope, purpose and importance. In its early stages, 
internal auditing was primarily concerned with the detection and prevention of 
fraud. Its main activity consisted of the verification of the authenticity and 
validity of charges and it dealt primarily with accounting and financial 
controls. As internal auditing evolved, greater emphasis was placed on a 
constructive audit approach, whereby as much interest was shown in internal 
controls to eliminate waste and inefficiency as in those controls maintained 


for the detection and prevention of fraud. 


Today, internal auditing is considered to be an essential tool of management 
which functions by independently reviewing and evaluating the effectiveness 
of other controls as a service to management. This modern concept of 
internal auditing indicates that the emphasis has shifted from dealing 
primarily with accounting and financial matters to any area of the entire 
organization where protective and constructive service to management can be 


provided. 


The current emphasis on improving the accountability of managers to 
governments, to Parliament and ultimately to the taxpayer, for the effective 
control and management of public money, imposes a responsibility upon 
internal auditors to expand the scope of their audits beyond the financial 


aspects of operations into all aspects of departments' and agencies' activities. 


These new Standards for Internal Audit in the Government of Canada describe 
the expanded scope of internal audit coverage which will enable internal 


auditors to provide senior management with an independent assessment of the 


vi 


economy, efficiency and effectiveness of internal management policies, 


practices and controls. 


The adoption of these standards by all departments and agencies should result 


in a substantial strengthening of the accountability process. 


President of the Treasury Board 
of Canada 
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INTRODUCTION 


Internal auditing is an important element of the accountability process since it 
provides senior public service managers with an independent systematic review 
and appraisal of all departmental operations for purposes of advising them as 
to the efficiency, economy and effectiveness of internal management policies, 


practices and controls, and identifying where improvements are needed. 


Although government policy since Glassco has recognized internal audit as an 
important element in the managerial control process, the Auditor General's 
1975 Financial Management and Control Study identified the following serious 


deficiencies: 


some departments had no internal audit function; 
- internal auditors were often diverted to other duties; 
- coverage was not consistent or comprehensive; and 


- staff was not sufficiently trained or familiar with its responsi- 


bilities. 


In order to rectify these deficiencies, the Treasury Board initiated a review of 
financial audit activities in departments and agencies, and in September 1978 
the Office of the Comptroller General issued the Standards for Internal 
Financial Audit in the Government of Canada which substantially expanded the 
direction given to internal audit groups. The purpose of those standards was to 
aid departments and agencies in establishing or reorganizing audit groups, 
conducting audits, reporting findings and promoting corrective action based on 


findings. 


While the publication of the Standards for Internal Financial Audit in the 
Government of Canada was an important milestone in establishing formal 
standards for internal audit, the Office of the Comptroller General recognized 
that it was only an initial step in the Treasury Board's plan to establish an 
integrated audit program in all departments and agencies, one which would 


examine all aspects of managerial control, financial and non-financial. 


Because the emphasis of modern internal auditing has shifted from dealing 
primarily with accounting and financial matters to any area of the 
organization where protective and constructive service to management can be 
provided, the Standards for Internal Financial Audit in the Government of 


Canada have been revised to reflect this new emphasis. 


These new standards are intended to be more than a mere codification of 
current practices tailored to existing capabilities. Purposely forward-looking, 
these standards include some concepts and areas of audit coverage which are 
still evolving in practice but which are vital to the accountability objectives 


sought in the internal audit of departmental and agency activities. 


Extensive training is required, both on the job and through formal education 
programs, to develop the level of expertise necessary to conduct internal 
audits according to these new standards. The Office of the Comptroller 
General in conjunction with the Public Service Commission and departmental 
internal audit groups is giving the highest priority to the development of 


suitable courses and training programs for internal auditors. 


It is hoped that these new standards will be the catalyst which will improve 
the quality of internal auditing and make it a more effective management tool 
which will contribute to the improvement of departmental management 


practices. 


Terminology and Application 


These standards apply to all federal departments and agencies which are 
subject to Treasury Board policy. The terms "department" and "agency" are 
used interchangeably throughout the document. All standards apply to 


departments and to agencies. 


The term "deputy head" indicates, as applicable, the deputy minister of a 
department or the head of an agency. Several other terms with specific 
connotations are employed throughout the document; their definitions are 


included in the Glossary. 


The contents of this document are summarized in 23 specific standards. 
Certain standards relate to practices deemed to be essential for good internal 
audit and shall therefore be applied without exception throughout the federal 
service. There are eight standards in this category, indicated by the use of the 
verb "shall" (1, 2, 6, 8, 12, 13, 20, 21). 


The 15 remaining standards employ the verb "should". Seven of these relate to 
the audit function (3-5, 7, 9-11). Although not mandatory, they would be 
applicable in most instances. Circumstances may occasionally render a 
standard inapplicable or less desirable than an alternative course of action. 
The eight remaining standards relate to conduct of the audit assignment (14- 
19, 22, 23). They are models of desired performance, by which the quality of 


the audit work is measured. 


To be effective, all the standards should be generally accepted by both 


auditors and management as indicators of good internal audit practice. 


SUMMARY OF STANDARDS 


CHAPTER ONE - ROLE OF INTERNAL AUDIT 


if Departments shall have an independent internal audit function that 
carries out a systematic review and appraisal of all departmental 
operations for purposes of advising management as to the efficiency, 
economy and effectiveness of internal management policies, practices 


and controls. 


CHAPTER TWO - SCOPE AND FREQUENCY 


2. ~ Scope 


The scope of internal audit shall encompass all aspects of a department's 


operations. The internal auditor assesses and expresses an opinion upon: 
a) The design, development, implementation, and operation of all 
systems, procedures, processes and_ controls, including 


computer-based systems; 


b) The reliability and adequacy of information available for decision- 


making and for accountability purposes; 


c) The extent to which available information is utilized in the 


decision-making process; 


d) The adequacy of protection afforded public funds and assets; and 


e) The extent of compliance with legislative, central agency and 


departmental directions. 


3. Frequency 
All major systems, functions and organizational units performing 
significant responsibilities should be examined within a period not 
exceeding three to five years. 

CHAPTER THREE - ORGANIZATION AND RELATIONSHIPS 

4, Reporting Relationship 
The head of the internal audit group should report to the deputy head. 

5. Audit Committee 
There should be an audit committee chaired by the deputy head, 
composed of executives whose attributes assure the provision of sound 
and objective counsel to the deputy head. 

6. Integration of Audit Activities 
All internai audit activities shall be integrated to eliminate overlapping 
and duplication of work, and to contribute to the efficiency of internal 
auditing within the department. 

7. Audit Agents 
Where audit agents are used, there should be a written agreement with 
each agent that specifies audit objectives, audit scope, reporting 


relationships, the authority of the auditors, and the rights of the 


department to examine audit documentation. 


CHAPTER FOUR - AUDIT INDEPENDENCE 


8. 


Audit Policy 


The deputy head shall approve and promulgate an audit policy which 
specifies the responsibility and authority of the audit group, outlines the 
scope and frequency of audit, and authorizes access to all departmental 


information necessary for the fulfilment of its mandate. 


The policy should specify the responsibilities of auditees and the internal 


audit committee vis-a-vis the audit process. 
Objectivity 
Members of the internal audit group should execute each aspect of 


assigned audit work in a manner which is, and is perceived to be, 


objective. 


CHAPTER FIVE - AUDIT STAFF 


10. 


Size and Skills 


The internal audit group should be of sufficient size and possess the skills 


necessary to carry out its mandate. 


Professional Development 


The internal audit group and the individual auditor should have a common 
obligation to develop and maintain professional skills through training 
courses, on-the-job training, personal self-improvement, and a formal 


program of annual appraisals. 


CHAPTER SIX - PLANNING AND SCHEDULING 


12: 


Long-term Plan 

A long-term plan of the activities of the audit group shall be prepared 
and documented to ensure that the organization's audit policy is met 
efficiently and effectively. 


Annual Schedule 


An annual schedule of planned audit assignments shall be prepared and 


submitted to the deputy head for approval. 


CHAPTER SEVEN - PERFORMING THE AUDIT 


14. 


DD: 


Assignment Planning 

Every audit assignment should be properly planned. 

Performance 

There should be a sufficient study and evaluation of the operational and 
management systems, procedures, processes and controls as a basis for 
conducting the detailed review and tests required to identify and 
disclose weaknesses and inefficiencies. 


Due Care 


Each auditor should exercise due care in the performance of the audit. 


Wie 


Evidence 


Sufficient valid and relevant evidence should be obtained and 


documented to support the content of audit reports. 


Supervision 


Staff engaged in all phases of an audit assignment should be subject to 


adequate supervision. 
Supervisory Review 
All audit work should be subject to a properly planned and documented 


review process conducted by the appropriate level of qualified 


supervisory staff. 


CHAPTER EIGHT - REPORTING 


20. 


2l. 


Assignment Report 


A written report shall be issued to appropriate officials of the 


department or agency at the conclusion of every audit assignment. 


The report must be timely, accurate, clearly stated, complete yet 


concise, and recommend corrective action when appropriate. 
Report to the Deputy Head 
A report shall be submitted to the deputy head at least annually on audit 


coverage, major findings, significant unresolved recommendations and 


any other matters requiring the deputy head's attention. 


22. 


2. 


Post-Audit Consultation 


Audit findings and recommendations should be discussed with relevant 
officials prior to issuing the report and their comments included in the 


report, as appropriate. 
Follow-up 
The internal audit group should assess whether appropriate follow-up 


action has been taken on the implementation of audit recommendations 


and it should report inadequate action. 
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PART ONE 


THE AUDIT FUNCTION 


Prod bse 


CHAPTER ONE 


ROLE OF INTERNAL AUDIT 


The departments and agencies of the Government of Canada are entrusted 
with enormous resources and the authority to employ them. Parliamentary 
democracy demands that the Public Service render a full accounting of its 
activities in administering this trust. This accountability process must be 
concerned not only with the purposes for which the resources were provided 
but with the manner in which they are applied. 


The importance of the accountability process is perhaps best expressed in the 
following excerpt taken from the Final Report of the Royal Commission on 


Financial Management and Accountability: 


"Accountability is the essence of our democratic form of government. It 
is the liability assumed by all those who exercise authority to account 
for the manner in which they have fulfilled responsibilities entrusted to 
them, a liability ultimately to the Canadian people owed by Parliament, 


by the Government and, thus, every government department and agency. 


Accountability is the fundamental prerequisite for preventing the abuse 
of delegated power and for ensuring, instead, that power is directed 
toward the achievement of broadly accepted national goals with the 
greatest possible degree of efficiency, effectiveness, probity, and 
prudence. Establishing the means of proper accountability is our 
fundamental concern. But we are concerned also with the institution of 
proper financial administration and controls, because they are essential 
both to maintaining sound overall management of government and to the 
rendering of a full account for the exercise of responsibility and 


authority." 


Sie 


The rapid growth of government expenditures and the increased complexity of 
government operations have resulted in an ever-lengthening chain of delegated 
administrative and operating authority. This process of delegating authority 
to lower levels does not diminish in any way the responsibility of the 
delegators. In order to ensure that their responsibilities are being adequately 
discharged in these circumstances, managers must have a means of influencing 
and monitoring performance in each of the delegated areas. To this end, they 


must establish within their jurisdictions adequate systems of internal control. 


Control can be described as a complex series of continual and interrelated 
activities which are designed to direct and monitor the affairs of an 
organization. There are three basic phases to this process: the planning 


phase, the monitoring phase, and the corrective-action phase. 


Planning is concerned with determining sound objectives for the organization, 
both as a whole and for each operational component. These objectives in 
total, and in the case of each operational component, provide the points of 
reference for the supporting control activities. Complete and comprehensive 


planning thus provides the foundation for the control function. 


The planning phase therefore is a precondition to effective control and 
establishes what is to be done, how and when it is to be done, who is to do it, 
and what is to be regarded as satisfactory performance. It includes a 
combination of measures, such as the establishment of objectives, priorities, 
resource requirements, policies, procedures, organization structures, budgets 
and standards of performance. These measures are established by those with 
requisite authority and together establish a framework for controlling the 


organization. 


In the monitoring phase, actual performance is observed and compared with 
the planned framework for control. Effective monitoring is dependent on the 
flow of timely, accurate, concise and relevant information to managers in such 


form that matters requiring attention can be easily discerned and acted upon. 


SHS. C 


During the corrective-action phase, measures are taken to solve problems 
indicated by deviations from the framework and to make revisions to the 


framework based on analyses of performance. 


Systems of internal control can vary widely depending upon the particular type 
of operation or activity that is involved. However, there is a common 
framework to every internal control system in the form of objectives, 
measurement of performance against those objectives, analysis and appraisal 
of the actual deviations and appropriate action, including the reappraisal of 


the objectives themselves. 
The control process can be expressed in terms of the following seven steps: 


~ development of objectives 

- measurement of results 

“ comparison of actual performance against objectives 
- analysis of the causes of differences 

- determination of appropriate managerial action 

- the taking of the action 


- continuing reappraisal. 


Thus, the control function begins with the defining of objectives and ends with 
the achievement of those objectives. It is a means to an end and not an end in 
itself. It constitutes the policies, programs and procedures by which 
Management can best assure the accomplishment of stated plans and 


objectives in the most effective manner reasonably possible. 


It is important that the internal control framework be adhered to, be as 
complete as necessary and remain relevant in the never-ending pattern of 
change in the federal government. Thus the internal control framework 


established by an organization must be periodically reviewed and verified. 


ihe: < 


Without such verification there may be no basis for control, and frequently no 
control. Internal control is of the utmost importance in the federal 
government because of the enormous resources it controls and the trustee 
nature of public funds. The objectives of internal control are to ensure the 
utilization of resources in compliance with legislative or other authorities; to 
protect funds and other public property from losses due to fraud, 
mismanagement or inefficiency; to provide data which will assist managers in 
ensuring that what is planned is accomplished; and to provide for full and 


accurate disclosure of results to a higher level of authority. 


Two fundamental aspects of an internal audit can therefore be identified. The 
first is to review, evaluate and report on the adequacy of the predetermined 
internal control framework. The second is to examine and evaluate 
performance in relation to this predetermined framework and to report the 
extent of compliance to management. Although internal audit is an integral 
part of the management process, it is independent of the day-to-day 
operations of the systems of internal control. The establishment and operation 
of a system of internal control, including monitoring systems, is the 
responsibility of management, not internal audit. In its "Statement of 
Responsibilities", the Institute of Internal Auditors describes this role as "...an 
independent appraisal activity within an organization for the review of 
operations as a service to management. It is a managerial control which 


functions by measuring and evaluating the effectiveness of other controls". 


The internal audit function can provide a highly valuable service to 
management by reviewing, appraising and reporting on all departmental 
operations, and providing an independent assessment to senior management as 
to the efficiency, economy and effectiveness of its internal management 


policies, practices and controls. 


Internal audit assists the deputy head by either providing assurance that the 


operations are well managed or by identifying weaknesses in management 


Bes 


policies, practices and controls and_ identifying opportunities for 
improvement. The facility to provide constructive audit observations to all 
levels of management permits the internal audit function to contribute to the 
overall administrative health of the department or agency. The audit function 
is an essential tool of management, complementing all other elements of 


management control. 


Therefore, it is Treasury Board policy that: 


ibe Departments shall have an independent internal audit function that 
carries out a systematic review and appraisal of all departmental 
operations for purposes of advising management as to the 
efficiency, economy and effectiveness of internal management 


policies, practices and controls. 


IRs 


CHAPTER TWO 


SCOPE AND FREQUENCY 


The purpose of this chapter is to set standards concerning the scope and 
frequency of internal audit in departments and agencies of the Government of 
Canada. The previous chapter states that the purpose of internal audit is to 
provide an independent assessment to senior management as to the efficiency, 
economy and effectiveness of its internal management policies, practices and 
controls. In order to appraise management policies, practices and controls the 
internal audit group must have the authority to examine all aspects of a 
department's operations. In addition, examinations must be carried out 
frequently enough so that the advice being provided to management is current 


and relevant. 
Audit Scope 


The Lambert Royal Commission on Financial Management and Accountability 
emphasized the need to expand the scope of internal auditing beyond the 
traditional financial functions and to include aspects of operational auditing 
such as the assessment of the economy and efficiency with which programs are 
being conducted, the examination of the validity of performance indicators 
and the review of compliance with administrative procedures. The 
Commission recommended | that: "the internal audit responsibility of 
departments and agencies be based on a comprehensive approach to all 
financial, operational, and management auditing, and that it therefore cover 
adherence to all centrally-prescribed financial, personnel, official languages, 
data processing, and other administrative policies and procedures, as well as 


the economy, efficiency, and effectiveness with which resources are used". 


Oe Ce 


The scope of internal audit activities must include all aspects of operations. 
Consequently, an assessment of all policies, processes, systems and procedures 
of management, including planning, program evaluation, performance 
measurement, financial management, personnel management, official 
languages management, electronic data processing, administrative and other 


support functions fall within the scope of internal audit. 


The scope of an audit should be defined in functional, rather than 
organizational, terms. That is, in terms of the policies, systems and activities 
that comprise the department's total responsibilities. This section identifies 
many of the elements to be included within the scope of internal audit in the 
Government of Canada. Because of the extensive range of government 
operations, each department must determine the precise scope of audit 
according to its own needs. This section sets out only the minimum required 


scope. 


Chapter One, "Role of Internal Audit", describes the two fundamental aspects. 
The first is to identify, review, evaluate and report on the adequacy of the 
predetermined internal control framework. The second is to examine the 
activities of the organization, to evaluate them in relation to the established 
framework and to report the extent of compliance to management. In each of 
the following sections it is assumed that the scope includes both these 


essential aspects. 
Departmental Policies, Systems and Activities 


The internal audit group will be primarily concerned with the evaluation of the 
policies, systems and activities established within the department. These 
must be consistent with the external requirements which are described later 
in this chapter. It is a fundamental responsibility of the internal audit group 
to review, evaluate and report on this framework which includes all 
departmental policies, systems and activities that contribute to control, 


accountability and visibility. 


@ 
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It should be emphasized that the scope of internal audit is not restricted to 
the policies, systems, or activities administered by any particular group or 
area within the department. It applies equally to the controls in any 
administrative or operational system. In this way, the audit group can assist 
management in meeting the objectives of internal control: to ensure the use 
of resources in compliance with legislative or other authorities; to protect 
funds and other public property from losses due to fraud, mismanagement or 
inefficiency; to provide data which will assist managers in ensuring, that what 
is planned is accomplished; and to provide for full and accurate disclosure of 
results to a higher level of authority. This scope includes the assessment of 
the design, development and implementation of all major policies, systems and 


activities and is not restricted to their application. 


In recent years managers at all levels have become increasingly dependent on 
electronic data processing for the information they need for planning, 
evaluation and control purposes. Consequently, they have become more 
concerned about the continuing accuracy and completeness of data processing 
results, and they have turned to internal auditors to provide them with the 
assurance that internal controls are effective and data processing results are 


reliable. 


Because of the complex nature of electronic data processing systems, internal 
auditors should become involved early in the systems development process in 
order to ensure that necessary audit and control features are built into new 
systems. They cannot afford to wait until new systems have been developed 
and installed before conducting an evaluation of internal controls. The cost in 
time and money of making modifications after systems have been implemented 
can Cause operational delays and may be used to argue against the inclusion of 


desired controls. 


The participation of internal auditors in systems development is further 


discussed in Appendix A. 


Peo ee 


Legislative Authorities 


The legislative elements of a government-wide control framework include 
statutes, regulations and Orders in Council. Paramount among these are the 
Financial Administration Act, the Public Service Employment Act and the 
Official Languages Act. Together, they delineate the managerial role of 
deputies and underline the fact that deputies are the chief administrative 
officers of departments and agencies. Examination of departmental policies, 
systems and activities for compliance with legislative authorities is a 


fundamental responsibility of the audit group. 


The internal audit group should also evaluate the auditability of any 
legislation, whether existing or proposed, for which the department is 
responsible. If any audit requirements of such legislation are, or will be, 
difficult to carry out, the group can play a vital role by pointing out the 
deficiencies. This is best done by giving constructive advice to senior 
management and to the relevant legislative planning groups in the department. 
The audit group can play a similar role with respect to important agreements 
and contracts made between the department and outside agencies so that 


compliance with such agreements can be more easily audited later. 


In some instances, legislation or regulations affect a department although the 
responsibility for their evaluation and maintenance lies outside that 
department. The Financial Administration Act is the chief example of this 
type of legislation. Although the internal audit group has no direct 
responsibility for evaluating such legislation and regulations, the views of the 
department concerning their effectiveness should be communicated to the 
appropriate authorities so that they can be considered during periodic reviews 
of the legislation. The internal audit group should be an important source of 


information and opinion in formulating the department's views. 


Loon 


Central Agency Policies 


The legislative elements of the control framework delegate certain areas of 
authority to the Treasury Board, the Public Service Commission and the 
Receiver General for Canada. Within their areas of jurisdiction, they have 
developed an extensive amount of policy which is communicated to 
departments in a variety of ways. Examination of departmental policies, 
systems and activities for compliance with central agency policies is a 
fundamental responsibility of the internal audit group. The internal audit 
coverage of these areas should be sufficient to permit the central agencies to 
determine the extent of compliance with their policies, directives and 
guidelines. As departmental internal auditing becomes more effective, 
compliance reviews conducted by central agencies can be reduced and largely 


eliminated. 


Treasury Board issues many policies whose review normally comes within the 
mandate of the internal audit group. For example, Treasury Board's Guide on 
Financial Administration is the chief medium for communicating policy in the 
area of financial administration. The Administrative Policy Branch maintains 
policies on such matters as materiel management, contracting, travel, 
accommodation, electronic data processing, relocation and hospitality, the 
Personnel Policy Branch administers personnel policies and the Official 


Languages Branch administers official languages policies. 


As with legislative elements, the departmental audit group has no direct 
responsibility for evaluating the effectiveness of these central agency policies. 
However, the group should, in the course of its audit work, be able to identify 
circumstances where there appear to be weaknesses in policies. This 
information should be systematically conveyed to the appropriate 
departmental officials for consideration in determining the department's 


position. 


cate 


Frequency of Audit 


Discussions on the frequency of audit have usually focused on a department's 
organizational components, such as regions, branches or responsibility centres, 
in spite of the fact that organizational components with these same generic 
descriptions may vary greatly in terms of size, systems and responsibilities. 
Experience over past years has shown that the definition of frequency of audit 
solely in terms of responsibility centres has tended to result in certain of them 
being given clearly unwarranted equal priority. To give equal priority to all 
centres may force the audit group to omit or delay examination of areas that 
demand more immediate attention, in order to meet the requirement to audit 


all responsibility centres within a specified time. 


There is a need for an alternative method of regulating the frequency of audit. 
The extent and frequency of recurring internal audits depend upon varying 
circumstances such as conditions found during previous audits, performance 
reflected in management reports, volume of transactions, and adequacy of the 
system of internal control. Therefore no set rules can be established as to the 
number of times each activity should be audited nor as to specific subjects 
which should be reviewed. Nevertheless, the audit group should be able to 
Satisfy itself about the adequacy of each major system, function and 
organizational unit performing significant responsibilities over a period of 
three to five years. The audit cycle should be commensurate with the risk 


resulting from the failure to audit a specific auditable unit. 


Because audit is a continual process, a reasonable portion of the total scope 
should be completed each year. Certain of the major components may require 
partial or comprehensive reviews each year, others less frequently. No major 


component should be left without audit for longer than five years. 


Chapter Six, "Planning and Scheduling", develops a method of long-range audit 


planning which includes the identification of manageable audit units. The 
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planning process, using a variety of criteria, will determine which audit units 


must be examined in order to provide adequate coverage of each component. 


This process may determine that an audit of every unit is not necessary during 


a cycle. On the other hand certain units may require examination more than 


once during the cycle. However, it is imperative that this determination 


result from a logical, thorough and well-documented planning process. 


Therefore, it is Treasury Board policy that: 
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The scope of internal audit shall encompass all aspects of a 
department's operations. The internal auditor assesses and 


expresses an opinion upon: 


the design, development, implementation, and operation of 
all systems, procedures, processes and controls, including 


computer-based systems; 


the reliability and adequacy of information available for 


decision-making and for accountability purposes; 


the extent to which available information is utilized in the 


decision-making process; 


the adequacy of protection afforded public funds and assets; 


and 


the extent of compliance with legislative, central agency and 


departmental directions. 


All major systems, functions and organizational units performing 
significant responsibilities should be examined within a period not 


exceeding three to five years. 
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CHAPTER THREE 


ORGANIZATION AND RELATIONSHIPS 


ORGANIZATION FOR AUDIT 


The organizational status of the internal auditing function and the support 
accorded to it by the senior management of the department or agency are 
among the major factors which will determine its effectiveness. The level in 
the organizational hierarchy at which the internal auditing group is placed, and 
the officer to whom the head of internal audit reports, determines to a major 
extent the authority of the internal auditing group. It also discloses to others 
in the department or agency the degree of commitment senior management 
has to the nature and scope of the internal auditing role. Without adequate 
organizational status there are very real limitations regarding access to higher 
level management officials and the kind of reception accorded to the internal 


audit group's role and mandate. 


Rather than discouraging flexibility by establishing rigid standards, this 
chapter is intended to encourage departments to organize in such a manner 
that their differing requirements can be accommodated. This must be done 
without impairment of the independence (and hence the effectiveness) of the 
audit group. It is essential that the organizational independence of the audit 
group be assured, notwithstanding the need to accommodate varying 
departmental requirements. It is recognized that a number of factors will be 
employed in determining the reporting level of the head of the audit group. In 
this respect Treasury Board encourages a direct reporting relationship to the 
deputy head, but factors such as the deputy's span of control or the size and 
nature of the department may make this impracticable. To provide an 


adequate degree of independence, the head of the internal audit group should 
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report to the deputy head or to another senior executive officer who reports 


directly to the deputy head. 


Independence is enhanced when the head of internal audit reports to an 
individual with sufficient authority to ensure broad audit coverage, adequate 
consideration of audit reports and appropriate action on _ audit 
recommendations. If the audit function does not report to the highest 
practical organizational level there is a danger that auditors will be subjected 
to internal management pressures which could compromise their independence 
and thereby diminish the overall effectiveness of the internal audit function. 
The head of the internal audit group should be independent of officials who are 
responsible for operations subject to internal audit. If appropriate reporting 
relationships are established and maintained, internal auditors will be able to 
carry out their work objectively and report their conclusions completely 


without fear of censure or reprisals. 


The internal audit function should be organized in a single group independent 
of the operations it must review. It should not be subdivided, with separate 
groups reporting to program managers. There are several reasons for this. A 
single internal audit group reporting to the deputy head, or to a senior 


executive officer who reports directly to the deputy head: 


- provides advantages of greater independence; 


~ fosters a broad viewpoint on the interrelationship of organizations 


and functions within a department or agency; and 


- places the internal auditor in a better position to make systematic 
and independent evaluations of and reports on all departmental 


programs, activities and operations. 
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A single audit organization also facilitates the attraction and retention of 
better managerial and staff capability, more effective staff use, and increased 
coordination of audit effort and interrelated findings. In addition, under 
unified direction and supervision, a single audit organization permits the 
devotion of a greater portion of total staff time to specific audit assignments 
and provides greater opportunities for tailoring staff assignments to the 


talents and experience of staff members. 


The Royal Commission on Financial Management and Accountability also 
recommended that audit activities within departments should be consolidated. 
In their Final Report to Parliament the Commissioners stated that "As the 
first step toward improving the effectiveness of internal audit we believe that 
existing audits should be consolidated. Because internal audit must be a 
management tool, the expanded audit responsibility resulting from _ this 


consolidation should be located within departments and agencies." 


In summary, the effectiveness of internal audit can be improved and flexibility 


can be maintained by observing the following: 


~ the head of the internal audit group reports, where practicable, to 


the deputy head of the department; 


~ in all other circumstances, the head of the internal audit group 
reports to a senior executive officer who reports directly to the 


deputy head; 


- the audit group is not subdivided, with separate groups reporting to 


program managers; and 


~ the group always, irrespective of the organizational relationships, 
conforms to the standards concerning the reporting of findings to 


the deputy head. 
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THE AUDIT COMMITTEE 


Evidence suggests that audit committees can safeguard the independence of 
the internal audit function and make a substantial contribution to an 
organization's governance and accountability. In response to this evidence, 
government policy has encouraged the use of audit committees and many 
departments have one already established. The work of these committees and 
their responsibilities and terms of reference vary widely because they are in 
different stages of evolution. The following guidance is provided to help 
departments and agencies establish smoothly-functioning audit committees. 
Sufficient flexibility is provided in order to facilitate the adaptation of audit 
committees to changing circumstances and to the particular situation in each 


department and agency. 
Objectives and Responsibilities of the Audit Committee 


Deputy heads have been delegated the responsibility for managing, directing 
and controlling departmental activities under various statutes and legislation, 
including the Financial Administration Act, the Public Service Employment 
Act, and the Official Languages Act. The size and complexity of 
departmental activities has made it necessary for deputy heads to further 
delegate these responsibilities to their senior management teams and 
subordinate staffs while remaining ultimately accountable for the 


administrative performance of their departments. 


Since they are removed from many of the day-to-day activities of their 
departments, deputies must be able to rely on the timely flow of relevant 
information to them, so that they can scrutinize the decisions and actions of 


their subordinates in order to hold them accountable. 
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An audit committee which has an understanding of the needs of departmental 
management, the central agencies, the Auditor General and the internal 
auditors can contribute to the effective planning of audit activities so as to 
fulfil the needs and clarify the expectations of all concerned. The committee 
can also make a substantial contribution towards improved accountability 
through the thoughtful review and challenge of managerial actions which are 


the subject of audit comments. 


Although an audit committee's specific objectives should vary depending on a 
department's or agency's circumstances, the following five broad objectives 


will normally encompass all relevant matters: 


~ to aid the deputy head in fulfilling his responsibilities for the 


administrative performance of his organization; 


- to strengthen the independence of the internal audit function 


within the department; 


- to emphasize the accountability of managers to government, to 
Parliament and ultimately to the taxpayer for the effective control 


and good management of public money; 


- to support all efforts to improve management practices and 


controls; and 


- to provide better communication between senior management, the 
internal audit function, the Auditor General, and the central 


agencies. 
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Composition of the Audit Committee 


An effective audit committee requires the full cooperation, involvement and 
support of management. In the absence of direct and active management 
participation in committee activities, the effectiveness of the committee may 
be impaired. Having managers represented on the committee reduces possible 
misunderstanding and conflicts between management, committee members, 


and the auditors. 


During the implementation period of the expanded role and scope of audit 
described by these standards, a committee made up entirely of senior officials 
from the department is a means of obtaining senior management's 
commitment to internal audit and helping it gain greater recognition and 


cooperation from other levels of management. 


As the internal audit function matures and the commitment of departmental 
management is assured, the introduction of outside members into the 
committee would be beneficial for the added objectivity and external 


experience that they can bring to the resolution of audit issues. 


The addition of deputy head level representatives from other branches of 
government represents one source of assistance that could provide for a 
second stage of evolution. However, senior executives from the private sector 
could be expected to provide greater benefits to the deputy head in terms of 
relating private sector experiences as well as a visibly impartial and objective 
viewpoint. The impartial review provided by external representatives should 
increase the confidence that groups external to the department (such as the 
general public, parliamentarians and central agencies) have in the 


departmental! administration. 


To summarize, successful internal audit in many departments depends on the 


support of an audit committee which, as a group, possesses both sufficient 
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knowledge of the day-to-day activities of the department and an adequate 
degree of independence and objectivity from the matters being discussed. 
Ultimately, it should be made up of both senior departmental officials and 


suitably qualified persons from the private sector. 


Direction on the introduction of private sector representation into 
departmental audit committees will await the results of selected trials and the 


formalization of guidance on the selection and appointment of candidates. 


Qualifications for Membership on an Audit 
Committee and Term of Committee Appointment 


To meet their responsibilities, audit committee members must possess an 
understanding of the department's or agency's mandate, its operations, its 
internal audit, its accounting and financial controls, the accounting and 
financial reporting principles of the federal government, and the overall 
government policies and environment within which departments and agencies 


operate. 


The most important attributes which an audit committee member must have 
are broad experience, open-mindedness and good judgment. An audit 
committee member must also have the personal independence of spirit to ask 
the questions that need to be asked, whatever his or her professional 
background may be. In addition, the audit committee member must be 
prepared to make reasonable commitments of time and accept important 


responsibilities. 


Departmental representatives on an audit committee should be selected from 
senior management ranks, preferably at the ADM level, who will contribute 
the required extensive knowledge of government and departmental operations, 
while external representatives would contribute successful private sector 
management experience and the ability to productively relate it to issues 


before the audit committee. 
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The term of appointment for members may vary based on such things as the 
background of the individuals, committee continuity requirements, and the 
particular wishes of the deputy head. However, a consideration in the 
selection of an external representative would be an expressed willingness to 


serve for at least a two-year period. 


Responsibilities of Audit Committees and 
Number of Meetings to be Held Annually 


Among the major responsibilities which an audit committee could perform are 


the following: 


discussing major audit reports and findings and identifying how 


findings in one area may relate to other areas; 


- considering issues raised by the Auditor General and the central 


agencies; 


- monitoring the corrective or preventive action taken on major 


audit findings; and 


~ reviewing the appropriateness of long-term and annual audit plans 


and the coordination with external audit groups. 


While these basic responsibilities pertain to all audit committees, the actual 
workload and focus of each committee would likely change as internal audit is 
implemented in the department. Initially, more members and frequent 
meetings may be required in order to closely monitor the implementation and 
acceptance of the full scope audit. As progress is made in this regard the 
committee can turn its attention to higher-level audit issues. This should 
entail fewer meetings and facilitate a reduction in the number of members 
required, to the point where there are only a handful. At this stage, three to 


five meetings per year should generally be sufficient. 
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Senior executives from the public and private sectors will generally have 
significant responsibilities in the pursuit of their ordinary occupations, and 
thus have a limited amount of time available to serve on an audit committee. 
The abilities and expertise of these people must be used carefully. This 
requires a clear definition of the responsibilities of the audit committee and 
the development of meeting agendas well in advance in order to allow 
members ample time to prepare themselves. 


Audit committees should carefully guard against overstepping their 
responsibilities and intruding into the management area. This is difficult, 
because there is a fine line which separates the respective roles of 
management and audit committee members. The terms of reference of the 
audit committee should be specified in writing and approved by the deputy 
head. The concept should be properly communicated to management in order 


to avoid conflict or misunderstanding. 


The head of the internal audit group should submit reports to the audit 
committee through the deputy head. Any relationship between the internal 
audit committee and the internal audit group should supplement, not replace, 
the relationship between the internal audit group and the deputy head 
specified in Chapter Eight, "Reporting". The head of internal audit should 
attend audit committee meetings, act as an advisor and provide staff support 


to the committee, but he should not be a member. 


Senior departmental officials should be invited to attend meetings during 
discussion of any items on the agenda for which they are responsible, in order 
to give the committee the opportunity to evaluate their responses to the 


opinion of the auditors and to evaluate their proposed corrective actions. 


The Treasury Board Secretariat and the Office of the Comptroller General 
recommend policies and establish standards and guidelines for financial, 


personnel and official languages administration, advise on the allocation of 
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resources and perform other functions having a direct effect on departments' 
and agencies' administrative performance. It may be necessary from time to 
time for departments to request senior officials from the Treasury Board 
Secretariat or the Office of the Comptroller General to attend audit 
committee meetings to clarify policy direction and provide advice on 


management or audit issues. 


Representatives from the Office of the Auditor General should also be 
requested to attend audit committee meetings to present their audit plans, 


discuss their audit findings and review problems encountered. 


Minutes should be kept of all audit committee meetings describing the topics 
covered and the conclusions reached and they should be submitted to the 


deputy head. 


RELATIONSHIPS 


This section discusses the relationships between the internal audit group and 


other groups or individuals, both within and outside the auditor's department. 


Some relationships are dealt with more appropriately in other chapters of this 
document. In such cases, only essential aspects are repeated. In other cases, 


a more detailed discussion is presented. 


The Auditee 


The establishment of good working relationships with all parties with which 
the audit group comes in contact in the department is essential to the conduct 
of effective and efficient audits. The auditor's most common contacts will be 
with departmental managers responsible for activities subject to audit, and 
with officers who carry functional or direct responsibility for areas subject to 


audit. 
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Good relationships can be developed with departmental staff if the auditors 
are constructive and fair in dealing with them. Although it is difficult to 
determine what is reasonable in all circumstances, it is possible to provide 
some examples of both good and bad audit practices. The audit group must 
ensure that departmental staff members at all levels are aware of its purpose 
and role, the extent of its authority and responsibility, and the audit approach, 
as they are expressed in its formal mandate. Individual auditors must receive 
advice and instruction in how to deal with auditees during the course of audits. 
Although the auditors have right of access to information, they should exercise 
it with prudence. Information made available to them should be treated with 
the degree of confidentiality required by the auditee. Auditors should strive 
to fulfil the role set out in their mandate, avoiding the reputation of 
departmental police. Nor should audit staff create the impression that their 


purpose is to conduct personnel evaluations of individual staff members. 


The reporting process is also vital to the establishment of sound 
audit/management relations. This subject is discussed in detail in Chapter 
Eight, "Reporting", but it is important to emphasize that the immediate 
manager of a unit being reviewed should be regularly informed of major 
findings. The contents of reports should be thoroughly reviewed with 
managers before reiease. Although a manager may not always agree with the 


content of an audit report, it should never come as a surprise. 
Other Evaluation and Review Groups 


The work of internal auditors does not in any way diminish the responsibility of 
line managers to ensure that adequate control is maintained in their areas of 
responsibility. This means that the design, development, implementation and 
operation of all regular control systems are the responsibility of management. 
Managers have the primary responsibility for ensuring that adequate controls 
exist in their areas of responsibility, and for this purpose they may establish 


appropriate mechanisms, including internal review groups which monitor 
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adherence to controls on their behalf on an ongoing basis. Managers should not 
be in the position of having to rely solely on the results of periodic internal 


audits in order to monitor adherence to controls. 


Throughout the government there are review groups forming an integral part 
of the control systems of the organizations in which they function. The duties 
of these review groups consist of a wide range of monitoring and problem- 
solving activities on behalf of the management to whom they report. Such 
activities are designed either to ensure adherence to a specific set of norms or 
standards, or to ensure that operations are functioning satisfactorily. These 
review groups identify on a timely basis deviations which may result in 


immediate corrective action or indicate a need for in-depth follow-up. 


The activities of such review groups are occasionally confused with internal 
auditing because they sometimes employ many of the same _ techniques. 
However, the independence, nature, scope and objectives of internal auditing 


distinguish it from other review groups. 


The internal audit role with respect to review groups is to periodically assess 
the activities of such groups to ensure that a properly functioning control 
process is in place and that control objectives which have been established by 
management are being achieved. In order to assess the adequacy of control 
systems and processes, the internal auditors perform limited tests of some of 
the procedures carried out by review groups. The testing of control 
procedures for purposes of determining the adequacy and reliability of control 
systems is an integral part of the internal audit process, but unfortunately it is 
also an area in which misunderstanding often occurs between auditors and line 
managers. In many cases, line managers view the work of internal auditors as 
an unnecessary duplication of the work which has already been carried out by 
their own review groups. In order to avoid this problem, internal auditors 
should ensure that line managers and other auditees have a clear understanding 
of the nature and purpose of audit tests designed to assess the quality of work 


carried out by review groups before such tests are carried out. 
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In addition to the review groups mentioned above, departments are also 
required to have an internal senior management function known as program 
evaluation. Program evaluation is the periodic, independent and objective 
review and assessment of a program to determine, in the light of present 
circumstances, the adequacy of its objectives, its design and its results, both 
intended and unintended. Matters such as the rationale for the program, its 
impact on the public, and its cost-effectiveness compared with other forms of 


program delivery are reviewed. 


Since program evaluation focuses on program results rather than internal 
operations, the required analysis may incorporate demographic and other 
information gathered from outside the department or agency. Those 
responsible for program evaluation frequently use management information, 
including cost and performance data generated within the organization, but 
are not concerned with assessing the systems, procedures and controls over its 
production. The assessment of such systems, procedures and controls is one of 


the major tasks of internal auditing. 


There is a need to ensure that internal audit and program evaluation plans are 
coordinated, that a close working relationship exists, and an exchange of 


information takes place between the two groups. 


The internal audit role with respect to program evaluation is similar to its role 
in relation to other review groups, that is, the internal audit responsibility is 
to assess the system and procedures to ensure that a properly functioning 
process is in place. Internal audit groups should avoid any duplication of effort 
with program evaluation groups, but they must nevertheless assess the 
adequacy of the program evaluation function as they would any other review 


activity. 
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Office of the Auditor General of Canada 


Internal audit groups have extensive dealings with representatives of the 
Office of the Auditor General of Canada. The internal audit function is 


subject to review by the Office of the Auditor General in order to: 


- assess compliance with government-wide policies on audit; 


- evaluate the effectiveness of the audit group as an essential facet 


of a department's systems of management control; and 


- assist in planning and conducting its own audits. 


The Auditor General Act, in Section 13, permits the Auditor General access to 
any records deemed necessary to fulfil that office's responsibilities. 
Consequently, all internal audit documentation, including reports and working 
papers, may be made available to representatives of the Auditor General. 
Internal audit groups should exchange, to the maximum extent practicable, 
schedules and audit information with the Office of the Auditor General in 
order to minimize duplication of effort, disruption of departmental staff, and 
audit costs on a government-wide basis. At the same time, the internal 
auditors must remember that they are part of the department's management 


process and this role must remain their highest priority. 


Treasury Board Secretariat and Other Central Agencies 


Internal auditors will have extensive dealings with central agencies such as the 
Personnel Policy, Official Languages and Administrative Policy Branches of 
the Treasury Board Secretariat as well as other organizations such as the 
Public Service Commission. The internal audit function will be required to 
provide information to policy groups so they are informed on the level of 


departmental compliance with central agency directives and guidelines. 
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As departmental internal audits become comprehensive, the requirement by 
the Treasury Board Secretariat and other central agencies to carry out 
reviews, in order to determine the degree of compliance with specific policies, 


can be significantly reduced. 
Treasury Board - Comptroller General 


The Comptroller General is responsible for establishing internal auditing 
standards and for regularly monitoring the adherence of departmental internal 
audit groups to the standards. In the first instance, the Office must be in a 
position to satisfy Treasury Board ministers that financial and operational 
systems and procedures are in place to provide appropriate economy, 
efficiency and effectiveness in government. A part of this responsibility 
includes the knowledge that there are satisfactory audit procedures for 


monitoring the operation of these systems in departments. 


To help fulfil its government-wide responsibilities, the Office of the 
Comptroller General has established the Internal Audit and Special Studies 
Division whose ongoing duties include the assessment of the internal audit 
function in each department, using the standards in this document as a basis of 
judgment. This assessment is intended to be an evaluation of all aspects of the 
function, including an examination of plans, schedules, audit programs, 
permanent files, audit working papers, reports, and other relevant 


documentation. 


In addition to this assessment process, the Office of the Comptroller General 
has established other mechanisms for providing coordination within the 
internal audit community. An advisory service is offered to audit groups to 
help resolve problems in such areas as organization, planning and reporting. In 
cooperation with the Public Service Commission, and as approved by the 
national Staff Training Council, training programs are prepared and presented. 


Representatives of the Office of the Comptroller General are involved in the 
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selection of senior internal audit officers. An Interdepartmental Advisory 
Committee on Internal Audit has been established, and is involved in projects 
which will have an impact on all audit groups. Because of its importance, the 


Terms of Reference of the Committee are reproduced in full as Appendix B. 


Audit Agents 


Many departments employ "agents" to conduct some or all of their internal 
audit. In this context, the term "agent"* denotes an individual or an 
organization hired under contract by a department to conduct audits. The 
Audit Services Bureau of Supply and Services Canada is a major agent of this 


type. 


Departments using agents for internal audit purposes interface with these 
agents in several different ways. Some departments engage agents to conduct 
a full internal audit; some supplement the work of an in-house audit group; 
other departments have all the audit field work done by agents and only have 
one or more internal staff members who, on a full-time basis, coordinate, 
analyze and initiate corrective action based on agents' reports. These are all 


acceptable forms of organization. 


Although actual audit work may be assigned to agents, the responsibility for 
the audit function remains with the department, thus the department has to 
ensure that the standards set out in this document are met. The department 


should have a written agreement with the agent which should clearly specify: 


*The employment of agents to conduct audits of recipients of contributions, 
cost-sharing payments, or government suppliers is not covered by this 
document. 
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the authority and responsibilities of the auditor, 
the scope of the audit work, 
the reporting relationships, 


the department's right to approve plans and schedules. 


The agreement should also allow the department sufficient access to the audit 


documentation to be satisfied that the standards are maintained and to obtain 


specific detail that supports the observations and recommendations made. 


Therefore, it is Treasury Board policy that: 
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The head of the internal audit group should report to the deputy 
head. 


There should be an audit committee chaired by the deputy head, 
composed of executives whose attributes assure the provision of 


sound and objective counsel to the deputy head. 


All internal audit activities shall be integrated to eliminate 
overlapping and duplication of work, and to contribute to the 


efficiency of internal auditing within the department. 


Where audit agents are used, there should be a written agreement 
with each agent that specifies audit objectives, audit scope, 
reporting relationships, the authority of the auditors, and the 


rights of the department to examine audit documentation. 
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CHAPTER FOUR. 


AUDIT INDEPENDENCE 


Independence is a concept that is extremely important to effective internal 
audit. A certain degree of independence is essential to permit the audit group 
to provide complete and impartial observations, comments and 
recommendations. In the context of internal audit, independence is the 
property of the relationship between the auditor and the auditee that ensures 
that the auditor's findings and reports will be influenced only by the evidence 
discovered and assembled in accordance with rules and principles of 


professional discipline. 


However, if an internal audit group is totally independent of the organization 
it is to serve, it will find it difficult to maintain a current knowledge of 
departmental operations and to gain the respect and confidence of 
management. The group may have achieved independent status but its 
usefulness to the management of the organization may be severely reduced. 
Thus it is important that the internal audit group have the support of manage- 
ment and be considered part of the organization's management team even 


though the audit work may be performed by an outside audit agency. 


A number of factors influence the degree of independence of an audit group in 
an organization. The preceding chapter sets out certain standards concerning 
the place of internal audit in a department's organizational scheme and how 
the group relates to external parties. Chapter Two discusses the importance 
of having the authority to examine all aspects of a department's operations 
and to determine the timing and frequency of such examinations. Chapter 
Eight states that the head of the audit group should have the right to report 
audit findings to any management level; this right also contributes to 


independence. Although the standards for organization, relationships, scope, 
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frequency and reporting play a vital role in establishing independence, several 
other factors come to bear. 


An audit group cannot be called upon to review or assess policies, systems or 
activities which it has developed or implemented and maintain its 
independence. It should not, therefore, be directly involved in these functions. 
Nor should the group have responsibility for any operational or administrative 
functions. This does not imply that the audit group cannot offer advice and 
review systems before implementation. In fact, this should be an important 
part of the audit effort, particularly where systems are complex and 
therefore expensive to design and implement. Chapter Two describes this 


responsibility in more detail. 


The independence of the audit group is also partly determined by the personal 
objectivity of its members. Objectivity is essential for an auditor to be 
effective. For the auditor, objectivity is the ability to examine facts and 
situations in an impartial manner so as to form conclusions and make 
recommendations based solely on the evidence examined. To gain acceptance 
and support for the audit function, it is particularly important that the 
auditor should not only be objective, but that this objectivity can be readily 
perceived. This means that each auditor must be free from the control or 
influence of the users of audit services and should not have, nor appear to 
have, any bias arising from association with the organization, activity or 


individuals subject to examination. 


In order to establish a sufficient degree of independence, the authority of the 
group and its responsibilities must be clearly enunciated in a departmental 
audit policy. This policy should cover all the subject areas discussed above. It 
is essential that it be communicated to all members of the audit staff, all 
officers and all other personnel who come into contact with internal auditors. 
The method employed to do so is left to departmental discretion. A typical 
approach would be to incorporate the policy in the administrative or 


departmental! policy manual. 
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This document should specify that the auditors are entitled access to all 
departmental information, records, documents and reports that they deem to 
be related to the fulfilment of their responsibilities. They should also have 
reasonable access to all departmental staff in order to obtain information and 


explanations relating to their examinations. 


In summary, the audit policy should be: 


- formal: written, and approved by the deputy head; 


~ promulgated: effectively communicated to all appropriate 


departmental personnel; 


~ specific: clearly identifying the authority being granted (scope, 


frequency and access to information); and 


- comprehensive: granting sufficient authority to the audit group for 


it to play its intended role. 


Therefore, it is Treasury Board policy that: 


8. The deputy head shall approve and promulgate an audit policy 
which specifies the responsibility and authority of the audit group, 
outlines the scope and frequency of audit, and authorizes access to 
all departmental information necessary for the fulfilment of its 


mandate. 


The policy should specify the responsibilities of auditees and the 


internal audit committee vis-a-vis the audit process. 


a. Members of the internal audit group should execute each aspect of 
assigned audit work in a manner which is, and is perceived to be, 


objective. 
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CHAPTER FIVE 


AUDIT STAFF 


The importance of internal audit and the complexity of its responsibilities are 
discussed in detail in other chapters of this document. The chapter on the role 
of internal audit emphasizes the significant responsibility of internal audit in 
the management process and the high degree of reliance which senior 
management places on the internal auditors’ appraisal of all departmental 


operations. 


Other chapters describe the broad scope of audit, the diversity and depth of 
technical skills required, the high standard of care and proficiency, and the 


need for highly developed communications skills. 


In view of these important responsibilities and required skills, great care and 
attention must be given to the selection and training of adequate numbers of 
qualified and experienced audit staff. This is particularly important, if the 
internal audit organization is to fulfil its mandate and meet the high 


expectations of management. 


The purpose of this chapter is to outline the standards by which each internal 


audit organization should be staffed, and its personnel trained and appraised. 
Group Characteristics 
No specific standard as to size and composition of the audit organization is 


possible, because this will vary from department to department and will be 


affected by a number of interrelated factors, including: 
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- the nature of the department or agency served by the internal 
audit organization (e.g. the extent of decentralization in the 
department, the complexity of programs and the degree of public 


sensitivity); 


- the size of the department or agency, i.e. the number of 


employees, total revenues and expenditures, and assets employed; 


- the adequacy of the systems of internal control; and 


~ the complexity of the department's system of administrative 
control and the extent of delegated authority (e.g. Government 


Contract Regulations). 


Chapter 6, "Planning and Scheduling", describes the need to identify and 
subdivide the total responsibility for an audit into the tasks to be performed 
(or manageable audit units) in order to meet the objectives as to scope, 
frequency and depth in the audits of the control framework and activities of 
the department or agency. As part of this planning process the head of the 
audit organization must calculate the human resources required to fulfil the 
mandate, taking into consideration all of the above factors. The staff 
requirements should be fully documented and directly related to the fulfilment 
of the total audit responsibility in the long-range plan. The staffing plan 
should indicate the resources to be obtained under contract from outside 
agencies. The services of an outside audit agency should be obtained at any 
time when it is considered more effective or efficient to do so. The standard 
for the use of audit agents is discussed in detail in Chapter 3, "Organization 


and Relationships". 


The internal audit manager must ensure that audits are conducted by personnel 
who collectively have the skills necessary for the type of audit that is to be 


performed. It may therefore be necessary for the audit organization to obtain 
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special expertise when carrying out certain audits. Special expertise may be 
obtained in a number of ways including hiring temporary staff, secondment 
from other specialized areas in government, or contracting with an outside 
agency. 


Since internal audit groups have the responsibility for reviewing computer 
systems, they need to either acquire or develop computer audit skills. 
Although all staff should have a basic knowledge of computer controls and 
auditability, some audit groups may also require in-house specialist expertise 
in EDP systems. These individuals may be employed in the use of computer- 
assisted audit techniques, development of computer audit programs, or special 
studies. They must possess extensive computer audit experience and in-depth 


training in audit and EDP systems. 
Appendix A describes the role of internal audit in computer systems. 
Individual Characteristics 


The degree to which internal auditing can aid management is proportionate to 
the capabilities of the audit staff and the freedom with which it operates. To 
be effective in carrying out the internal audit mandate described in 
Chapter One, a mix of skills and disciplines is required. In addition to the 
need for staff adequately trained in the fundamentals of auditing, expertise in 
most functional areas including finance, planning, personnel, administration, 
official languages, etc., is required. This should be coupled with a good 
understanding of the operations being reviewed. This latter capability may be 
obtained in a number of ways, including secondments of specific operational 
personnel into internal audit as part of a career development program, 
contracting for such services when required or establishing a permanent 


capability through the regular staffing process, if warranted. 
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The qualifications of the staff assigned to the audit should be commensurate 
with the scope and complexities of its audit assignments. The qualifications 
mentioned above should apply to the skills of the audit group as a whole, and 
not necessarily to individual auditors. For example, if an audit organization 
includes staff members or consultants with acceptable skills in finance, 
planning, personnel, official languages, administration and other fields, each 


individual member of the audit group need not himself possess all these skills. 


In addition to the technical and professional knowledge and skills described 
above, the individual auditor should have other such important skills and 
qualities as: communications skills, both oral and written; good working 
relationships; interpersonal skills (tact, diplomacy and the ability to adapt to 
situations); and analytical skills, initiative and self-motivation. Auditors with 
supervisory or managerial responsibilities must have demonstrated strong 


administrative ability. 


The head of the internal audit organization should have sufficient experience 


and formal training: 
- to participate as a member of senior departmental management; 


- to advise the deputy head and fellow senior officers as to the 
efficiency, economy and effectiveness of internal management 
practices and controls and their compliance with departmental, 


legislative and central agency requirements; and 


~ to plan, organize, direct and control the activities of a professional 


audit organization. 
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Development of the Auditor 


The increasing complexity of government requires that internal auditors 
develop their professional skills to be fully effective. It is therefore necessary 
that each audit group have a formal plan for training and development, which 
will encourage individual initiative and develop the competence that will 
enable the auditor to undertake his or her work with confidence and a 
professional approach. Elements of a training and development plan could 


include: 


- an orientation program for new auditors to give them an under- 
standing of their department's or agency's purposes, objectives, 
programs, policies, operations, activities, and related basic 
legislation; its budget, fiscal, and accounting procedures and those 
of the federal government generally; legal and regulatory 
requirements; accounting and auditing principles and procedures; 


and management practices common to all organizations; 


- access to up-to-date reference material; 


- job enrichment by means of a variety of assignments; 


- on-the-job supervision; 


- encouragement of individual programs of self-improvement; and 


participation in formal training programs, in-house and external. 


A program of employee appraisal is another important factor in achieving a 
high standard of audit performance and in the development of the auditor. A 
formal written appraisal, prepared by the audit manager and discussed with 


the auditor, should be prepared at least annually. The annual appraisal should 
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point out the auditor's strengths and weaknesses in relation to the duties of his 
or her position; describe short-term and long-term goals, and progress made in 


achieving goals since the past appraisal; and identify training needs. 
Therefore, it is Treasury Board policy that: 


10. The internal audit group should be of sufficient size and possess the 


skills necessary to carry out its mandate. 


ll. The internal audit group and the individual auditor should have a 
common obligation to develop and maintain professional skills 
through training courses, on-the-job training, personal self- 


improvement and a formal program of annual appraisals. 
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CHAPTER SIX 


PLANNING AND SCHEDULING 


One major task facing the head of an internal audit group is planning the 
coverage. Planning gives the group head a means of ensuring that every 
component of the audit group's responsibility is considered, and of organizing 
the work in a manner that will gain the greatest benefits for the department 
from the resources available. Planning is a prerequisite for directing and 
controlling audit activities and for measuring the performance of the audit 
group. It can also help in communicating the activities of the audit group to 
the deputy head, senior managers, the Treasury Board, the Office of the 
Auditor General, the Office of the Comptroller General and audit staff. 


The process can be divided into four phases, which should be systematic, 


logical and fully documented and should: 


~ describe the total audit responsibility in terms of manageable audit 


units; 
~ evaluate and rank the audit units in order of priority; 
- prepare a long-term plan; and 
- prepare an annual schedule of the audit work. 
PHASE I - IDENTIFY MANAGEABLE AUDIT UNITS 
The audit of a department or agency can be a large and complex operation, 


involving hundreds of organizational units and many thousands of hours of 


audit work. In order to carry out this sizable undertaking effectively, the 
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audit head must subdivide and describe his or her total audit responsibility, as 
set out in the formal audit mandate, in terms of the tasks to be performed - 
the manageable audit units. The audit units should be established in such a 
way as to provide a basis for effectively planning, controlling and executing 
the audit work. An audit unit is a potential assignment of manageable size, 
but of such scope and nature that, if audited with due care, it will produce 


significant and meaningful information for management. 


There is no standard model for identifying audit units, nor is it practical to 
attempt to develop one for application on a government-wide basis, because of 


the varying nature of departmental operations. There are two preconditions: 


- there must be an audit mandate, approved by the deputy head, 
which clearly defines the objectives of the audit organization, 
states its authority, and specifies expected coverage and 


frequency; and 


~ the audit organization must have an in-depth understanding of the 
department's programs, organization, legislation, and management 
and control policies and practices. Where up-to-date knowledge 
does not already exist within the audit organization, steps should 
be taken to obtain it through interviewing appropriate officers and 


studying pertinent documentation and reports. 


When establishing manageable audit units it is important to look at the total 
audit responsibility from a functional, organizational and program viewpoint 
and not merely identify every responsibility centre. In a small, highly 
centralized department or agency the entire organization may be described as 
a single manageable audit unit. In a large department the audit unit may be a 
component of a function, a program, an organization, or any portion or 
combination of these. 
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The need to visit a specific organization depends upon the manner in which 
responsibilities are assigned and on the location in the department where 


control is exercised. 


For example, controls are frequently established at higher levels to monitor 
and control activities at lower levels in the organization. By concentrating 
audit effort initially on the higher levels it may be possible to satisfy audit 
requirements without examining the detailed procedures and transactions at 
the lower levels. Only where the controls are inadequate at the higher levels 


would it be necessary to extend the examination to the lower levels. 


It is usually extremely difficult to obtain a valid opinion of a policy matter, or 
of a department-wide procedure or practice, by concentrating audit work at 
the responsibility centre levels. An audit unit established for the review of 
the adequacy of a major component of a function should normally include the 


headquarters level where the overall responsibility for the function rests. 


It should be determined if the review of compliance can be carried out 
concurrently with the appraisal of the adequacy of the framework or can 
better be achieved on an organizational basis. A useful planning technique is 
to set out the components of the function and groups of organizational units as 
a matrix in order to view various alternatives and combinations in designing 


the audit units. 


To ensure that the list of audit units remains relevant, it should be continually 
updated as additional knowledge is gained from carrying out audit work and as 


changes are made to the systems of administration. 
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PHASE Il - RANK THE AUDIT UNITS 


Having identified the manageable audit units, the audit head should be able to 
identify which units are fundamental and necessary in assessing the adequacy. 
of the function and which are discretionary. This is particularly important 
where there are limited resources, because it forces the audit manager to 
focus his or her attention on those areas where use of the available resources 


' would best achieve the departmental audit objectives. 


In ranking the audit units the following criteria should be considered: 


Size 


The size of an audit unit is usually determined by the revenue generated, 


the expenditure made and the assets controlled. 


Risk of Loss 


Risk is a function of the extent and reliability of the control system, the 
vulnerability to loss through fraud and mismanagement, and the liquidity 


of the assets managed. 


Special Considerations 


Some key components of the major functions, such as management of the 
function and the budgetary process, cannot easily be ranked according to 
the previous criteria. Nevertheless, evaluation of these aspects is 


necessary in assessing the adequacy of the function. 
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Major Changes 


These are major changes in systems or organization, the implementation 
of new systems, the establishment of new organizations, and changes in 


key personnel. 
Previous Internal Audits 


The date, findings and recommendations of previous audits, as well as 
the extent of follow-up and corrective action by management, can be 
used to assess priorities. The discovery of major deficiencies in one unit 


may necessitate audits of similar units. 
Work Performed by Other Auditors 


The reports and audit plans of the Auditor General and other evaluation 


groups should be taken into account. 
Known Desires of Senior Management 


Consideration should be given to management requests for specific 
audits. The internal auditor must ensure, however, that in meeting these 
requests, the internal audit function does not become part of the line 


management, nor of the system of internal control. 


During the ranking of the audit assignments the audit manager should seek the 
advice of senior managers and the departmental audit committee. Their 
suggestions, based on knowledge of the department, and their concerns are 
invaluable in identifying the audits which can be expected to bring significant 
results. Such consultation can also be extremely useful in gaining support for 


the internal audit function in general and the audit assignment in particular. 
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The manageable audit units are then listed in order of decreasing priority. 
This ranking provides the audit organization with a useful tool in deciding what 


is to be done and when it is to be done. 
PHASE III - PREPARE LONG-TERM PLAN 


During this phase the audit head plans the activities of the audit organization 
to best meet the audit mandate, allocating known and planned resources to the 
ranked units in order to establish a long-range plan of work. The planning 
period normally is consistent with the frequency of audit established in the 
mandate. The long-range plan should attempt to provide some balance, so that 


a variety of functions and organizational units are covered annually. 


The plan should be flexible enough to allow for audit requests by management, 
for special studies demanded by unforeseeable circumstances, and for follow- 


up reviews on the actions taken on recommendations. 
PHASE IV - PREPARE ANNUAL SCHEDULE 


During this phase specific assignments to be carried out in the year ahead are 
scheduled. The schedule provides a basis for directing, controlling and gaining 


approval of the activity. 


The schedule should define the scope and objectives of each assignment and 
estimate time and resources. In allocating resources, audit management must 
ensure that the capabilities of their staff are sufficient to achieve the 
objectives of the assignment. Provision should be made for professional 
development, leave and administrative duties; failure to do so will lead to 


disruption in the schedule. 


The schedule should be developed to ensure that audit effort is effectively 


coordinated. Audit assignments should be phased so that full use can be made 
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of knowledge gained from completed work, when carrying out subsequent 
related work. 


The operational cycle of the organization to be audited should be taken into 
consideration in preparing the schedule. In many instances it is important to 
time the visit so that the auditor may observe an operation or activity as it 
occurs, as in the case of a pay distribution or inventory verification. 
Although the auditor must attain his objectives, he should attempt to do so 


with the least possible disruption of operations. 


Whenever possible, audit schedules should be compared with those of the 
Office of the Auditor General in order to prevent overlapping visits and undue 


interference with operations. 


Because the audit schedule communicates the activities to the deputy head, it 
should be supported by a narrative which relates the schedule to departmental 
requirements on scope and frequency. Deficiencies in coverage and the 
reasons for the deficiency should be highlighted so that the deputy head is 


aware of the risks involved. 

Therefore, it is Treasury Board policy that: 

12. A long-term plan of the activities of the audit group shall be prepared 
and documented to ensure that the organization's audit policy is met 


efficiently and effectively. 


13. An annual schedule of planned audit assignments shall be prepared and 


submitted to the deputy head for approval. 
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CHAPTER SEVEN 


PERFORMING THE AUDIT 


PRIMARY PURPOSE OF INTERNAL AUDITS 


The purpose of this chapter is to establish standards for the performance of 
internal audit assignments. Chapter One states that the purpose of internal 
audit is to provide an independent assessment to senior management as to the 
efficiency, economy and effectiveness of its internal management practices 


and controls. 


An overall objective of internal audit is to bring about improvements in the 
management and conduct of departmental programs and activities, including 
administrative activities, by identifying opportunities for improvement, 


reporting them, and making appropriate recommendations. 


Internal audit can contribute to improving departmental operations and 
ensuring that departmental goals and objectives are achieved with the greatest 
possible degree of efficiency, effectiveness, probity and prudence by 


providing information on such questions as whether: 


- systems, procedures and controls are adequately designed and 
developed and whether they are operating efficiently and 
effectively; 


- adequate information is available for decision-making and 


accountability purposes; 


- available information is properly utilized in the decision-making 


process; 
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- public funds and assets are adequately protected; and 


- legislative, central agency and departmental directives are being 


complied with. 


In carrying out audit work, particular emphasis should be placed on operations 
or activities suspected or found to require improvement or correction and on 
the means of accomplishing it. Internal audit should not only stimulate 
corrective action but should also promote the avoidance of future occurrences 
of deficiencies or problems such as those encountered during the course of 


carrying out audit assignments. 


After identifying an important problem area, the auditor should determine 
whether it is an isolated or a recurring problem. If the problem is found to be 
of a recurring nature, he or she should ascertain the causes and carefully 


consider and recommend the actions necessary to correct the basic problem. 


This approach to auditing and reporting will result in greater concentration on 
the basic problems that permit instances of waste, inefficiency or 
ineffectiveness to occur. It also results in emphasizing the improvements 


which need to be made in management policies and methods. 


To effectively carry out his audit responsibilities, the auditor must promptly 
communicate audit results including his or her findings, conclusions, and 


recommendations to the appropriate departmental and agency officials. 
BASIC DEPARTMENTAL AND AGENCY RESPONSIBILITIES 


Carrying out operations efficiently, economically, and effectively is a basic 
management responsibility. Each department and agency is also responsible 
for managing and using its resources--funds, property, and personnel--for 


authorized programs, activities, or purposes only, and conducting its programs 
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or activities in an effective, efficient, and economical manner to achieve the 
objectives established or intended by Parliament. Each department and 
agency's system of organization, management, and control should be designed 
to accomplish these ends, with due regard to the requirements of applicable 
laws and regulations. 


The primary responsiblity for establishing and maintaining adequate systems of 
accounting and internal control, including internal audit, is vested in the 
heads of departments and agencies themselves. The accounting systems 
established, however, must conform to the principles, standards and related 


requirements prescribed by the Comptroller General. 


In addition, the establishment of effective controls is required as a matter of 
good management practice. Internal audit should evaluate the effectiveness 
of internal management controls, including accounting systems, as a basis for 
discharging its responsibilities. When it observes opportunities for achieving 
greater economy, improving efficiency, or obtaining better results, it should 


make appropriate recommendations to senior management. 
INTERNAL AUDIT OBJECTIVES 


Internal audits should extend into all important aspects of a department's or 
agency's operations. They are not restricted to accounting matters or to 
books, records, and documents. The purpose of this section is to describe some 


general types of internal audit assignments and their related objectives. 


The technical nature of an operation does not, in itself, remove it from the 
purview of internal audit. The administration of such operations is within the 
scope of internal audit responsibility. However, if expert technical advice and 
assistance from outside the audit group are considered necessary in 


conducting such audits, arrangements should be made to obtain them. 
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Internal audit assignments can generally be classified according to the 


following four major categories: 


audits to assess the integrity of financial and other information; 


audits to assess the adequacy of controls over public property, 


revenues and expenditures; 


audits to assess the degree of compliance with objectives, policies, 


plans, procedures, laws and regulations; and 


audits to assess the extent to which there is management with due 


regard for economy, efficiency and effectiveness. 


Audits of the Integrity of Financial and Other Information 


In audits of the integrity of financial and other information, the audit 


objectives are to evaluate whether the department's or agency's information 


system: 


provides reliable information for decision-making and account- 
ability purposes; 


provides reliable information for the government's central 


accounting and financial reporting system. 


Audits of the Adequacy of Controls Over 
Public Property, Revenues and Expenditures 


In audits of the adequacy of controls over public property, revenues and 


expenditures, the audit objectives are to evaluate whether the department or 


agency: 
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- controls and accounts effectively for its funds, property, and other 


assets as well as the liabilities incurred in its operations; 


- collects and properly accounts for all revenues and receipts arising 
from its operations. 


Audits of Compliance with Objectives, Policies, Plans 
Procedures, Laws and Regulations 


In audits of compliance with objectives, policies, plans, procedures, laws and 
regulations, the audit objectives are to evaluate the extent of adherence to 
both departmental and centrally-prescribed financial, personnel, materiel, 
official languages, data processing and other administrative policies and 


procedures. 
Audits of Economy, Efficiency and Effectiveness 


The definitions of the terms economy, efficiency and effectiveness which 
follow are consistent with those contained in the i978 Report of the Auditor 


General. 


Economy refers to the terms and conditions under which resources of all kinds 
(personnel, materiel, equipment, land, buildings, etc.) are acquired. An 
economical operation acquires the resources necessary for the operation in 
appropriate quantity and quality at the lowest possible cost. Thus, economy 
deals with acquiring resources. It is concerned with quantity, quality and price 
of resources purchased. The specific audit objectives in an economy audit are 


to assess whether: 


- the need for the resources has been clearly defined and related to 


program objectives; 
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- there has been an appropriate determination of quantity, quality, 


performance and other relevant requirements; 


- alternatives such as "make or buy" have been considered, based on 


appropriate cost analyses and comparisons; and 


- resources have been acquired at the least cost, consistent with 


quantity, quality and performance requirements. 


Efficiency refers to the relationship between goods or services produced and 


resources used to produce them. 


The efficiency of a government program or operation depends on how well 
resources of all kinds (human, materiel, equipment, buildings, etc.) are used to 
produce the goods and services necessary to accomplish a_ program's 
objectives. An organization is most efficient when it produces the largest 
possible output for a given amount of input (resources) or when the 


organization meets its goals while incurring the least cost. 


In order to assess how efficiently a program, organizational unit or operation 
is managed the auditor may audit any issue related to managing efficiency. 


The scope of an efficiency audit may include: 


- the planning process. Operational planning and budgeting will 


influence the efficiency of an operation; 


- operational controls and processes. These help to maintain 


efficiency at a satisfactory level; 


- performance measurement and reporting. These tell the manager 
how efficient his or her operation is and where room for 
improvement exists. The auditor may assess the level of efficiency 


achieved by the auditee; 
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- what managers and others are doing to improve efficiency; 


- controls to maintain quality and other characteristics of output and 
level of service which will influence the efficiency of an 


operation. 
The specific audit objectives in an efficiency audit are to assess: 
- the adequacy of management controls used by the auditee to 
maintain both efficiency and the quality of service at satisfactory 


levels; 


- the adequacy and reliability of the system or procedures that an 


auditee uses to measure and report performance; 
- the auditee's present level of efficiency; 
- the auditee's efforts to improve efficiency; 


- the desirability of measuring and reporting performance if the 


auditee is not doing so. 


To meet these specific audit objectives the auditor must audit the systems, 
measure the resources being wasted because of weaknesses in these systems, 
and identify opportunities for further savings through more efficient operating 


methods. 


Program Effectiveness indicates the extent to which a program achieves its 


objectives, goals or other intended effects. 


Operational Effectiveness indicates the extent to which operations achieve 


their objectives or goals. 
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In audits of effectiveness, the audit objective is to assess the adequacy of 
management systems that evaluate and report the extent to which program 
and operational objectives, goals and effects are being achieved. It is not the 
responsibility of internal audit to question the appropriateness of program 
goals or values underlying them; this is the responsibility of the program 


evaluation function. 
Individual Audit Assignment Coverage 


For each assignment, specific objectives must be established within the 
framework of the general objectives listed above. On any specific audit 
assignment, it will seldom be possible, or practical, to do enough work to 
permit internal audit to fully evaluate at one time the peformance of a 
department's or agency's activities in all four audit categories described 
above. However, over time, the audit coverage of each department and 
agency should embrace all four categories of audit. 


THE INTERNAL AUDIT PROCESS 


The basic operations performed in achieving specific audit objectives 


established on specific assignments consist of an integrated combination of: 


- gathering information; 
- verifying and assessing the accuracy and adequacy of information; 


- developing recommendations, where appropriate. 


One of the most important methods of obtaining needed information in an 
audit is by reviewing and testing the manner in which various kinds of 
responsibility are carried out. Much of the needed information can be 
obtained by examining individual transactions or items. The main purpose of 
obtaining information in this manner, and making related evaluations, is to 


test the effectiveness of management control over the activity, program, 
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function, or operation being examined and to establish a proper basis for 


reporting on the results of the audit. 


Other important information-gathering procedures are the use of 
questionnaires distributed on a sample basis and interviews with departmental 
employees and officials. 


The internal audit process should include the following broad phases of work: 


- the assignment planning phase; 
~ the review phase; 

- the evaluation phase; 

- the verification phase; 


~ the assignment reporting phase. 


The first four phases of the internal audit process are discussed in this 
chapter. The fifth phase, assignment reporting, is dealt with in the following 
chapter along with such related topics as summary reports and follow-up 


procedures. 


I The Assignment Planning Phase 


Efficient performance of an audit requires careful advance planning of the 
work to be done, identification of specific, attainable objectives, and adequate 
written work programs for each phase of work to facilitate control and 


supervision over performance. 


Once the scope and objectives of each audit assignment have been identified, 
at the annual schedule stage, a specific plan of action should be developed 
before work begins. The auditor must carry out sufficient research to decide 
what matters to emphasize and select the appropriate audit approach and 
techniques. These preliminary decisions may be modified as a result of 


information obtained during the audit. 
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The planning phase consists of obtaining and documenting background 
information on the audit unit, to gain an understanding of its operations, 
procedures and personnel. The information gathered should include internal 
information on operations and sufficient external information to be able to 


place the operations in proper perspective. 


Recent financial data, estimates, organization charts, audit planning notes, 
~ and permanent files can be examined to identify the areas which are likely to 
be most relevant in the current audit. Discussions should also be held with 
appropriate officers to identify recent changes in systems, operations or 
personnel. Extracts from all legislation, regulations and policies applicable to 
the audit unit should be prepared for the working papers, to the extent that 


they give rise to audit considerations. 


At this stage, the auditor should gather information regarding the extent of 
computerization and determine where the computer fits into the system. An 
adequate internal audit cannot stop at the point where computer processing 
begins. The proper audit approach in a computer environment includes a 
complete consideration of computer control objectives and standards and 
computer-oriented audit techniques. In particular, the auditor should 
ascertain the extent and nature of EDP facilities: in-house, off-site 
distributed processing systems, or on-line systems. Appendix A describes the 


role of internal audit in computerized systems in greater detail. 


If the area subject to audit has been previously reviewed by other groups such 
as the Office of the Auditor General, the Security Evaluation and Inspection 
Team of the RCMP or the Commissioner of Official Languages, reports may 
be available which will be useful to the auditor in determining the direction 
and depth of the examination. In addition, reports and working papers 
resulting from previous internal audits will be a major source of information 


during the planning phase. 
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The information gathered during the planning phase will allow the auditor to 
determine which policies, systems and activities warrant examination. 
Previously identified control weaknesses, the nature of the activities, 
management concerns, systems changes, and materiality are major factors in 


these determinations. 


Once the size, nature and complexity of the audit assignment are established, 
the skills required in the various parts of the audit assignment can be 
determined. Audit management can then assign staff with the appropriate 
skills, to ensure the effective and efficient execution of the assignment. An 
important result of effective staffing arrangements is a continued increase in 


the level of competence of all members of the audit team. 


To ensure that planning decisions reached during this phase are properly 
implemented, and to provide useful information to the management of the 
audit group ‘in formulating planning decisions, a time budget should be 


developed for each part of the audit assignment. 


Finally, decisions regarding objectives, scope, audit approach, time budgets, 
and assignment of staff should be documented in an assignment memorandum. 
This should also set out the decisions reached concerning resource 
requirements, including the use of agents and outside specialist staff, and 
supervision and review arrangements. The assignment of responsibility for the 
drafting of the report, and any constraints such as availability of auditee staff, 
must also be documented. The potential impact of the assignment on future 
assignments should be recorded. The memorandum is essential to ensure that 
each staff member understands the objectives of the assignment and the basic 


approaches to achieving them. 
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Il The Review Phase 


The review phase of an audit is devoted to the preliminary gathering of 
information and testing processes to identify problems or other matters 


warranting detailed examination. This phase encompasses: 

Gathering General Working Information 

General working information on the program or activity being audited should 
be obtained and reviewed in as short a time as possible. This information 
should be used in planning succeeding phases of the audit and as a source of 
reference in carrying out the detailed examination work. 


Studying Legislation 


The pertinent laws and legislative history should be carefully studied to 


ascertain: 


- the purpose, scope, and objectives of the activity or program being 


examined; 


- the manner in which they are to be conducted and financed; and 


- the nature and extent of the department's or agency's authority and 


responsibility. 


Limited Testing of Management Controls 


The policies established to govern the activities under examination should be 
analyzed for conformity with applicable laws and regulations and their 
appropriateness for carrying out authorized activities or programs in an 


effective, efficient and economical manner. 
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The auditor should also obtain practical working information on how the 
department's or agency's system of controls actually works by testing the 
effectiveness and usefulness of controls over specific work activities. This 
information is useful in identifying possible management weaknesses and 
other matters on which the expenditure of additional time and effort will be 


warranted during the evaluation phase. 


When the review phase is complete, the auditor should be able to clearly 
identify important issues and problems to be examined in more depth. Review 
information should be used to establish specific audit objectives, estimate 
staffing requirements, schedule work at specific locations, prepare work 
programs, and establish target dates for completion of the evaluation, 


verification and reporting phases. 
Ill The Evaluation Phase 


In this phase the auditor must evaluate the design of the internal control 
framework to determine whether it will: ensure the utilization of resources in 
compliance with legislative or other authorities; protect funds and other public 
property from losses due to fraud, mismanagement or inefficiency; provide 
data which will assist managers in ensuring that what is planned is 
accomplished; and provide for full and accurate disclosure of results to a 
higher level of authority. The analysis consists of comparing the design of the 
framework, as documented in the review phase, with a predetermined control 
model, and requires the application of an appreciable amount of expert 
judgment on the part of the auditor. The use of standard control 
questionnaires or checklists may assist the auditor in the complete and 
systematic application of this predetermined model. However, care must be 
taken, because a standardized questionnaire or checklist is, by its nature, quite 


general and may require adaptation to specific circumstances. 
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The result of this evaluation will be the identification of the control 
deficiencies and inefficiencies in the framework. The deficiencies include 
control weaknesses, and all failures to comply with the external requirements 
of Parliament, central agencies or the department (external requirements may 
include headquarter directives where the audited unit is a branch or regional 
office). The auditor should also be alert for other controls which compensate 
for apparent weaknesses in the area under audit. The effect of these 
compensating controls, as well as environmental controls, must also be 


thoroughly evaluated. 


It is normally not cost-effective to carry out in-depth verification of all 
controls; the auditor should therefore identify those areas where there is the 
greatest potential for considerable loss or error. This requires identification 
of essential controls, significant weaknesses and major inefficiencies. 
Essential controls are those considered by the auditor to be critical to the 
effective operation of the system. A significant weakness is the absence or 
ineffective operation of an essential control. All failures to comply with 
mandatory external requirements are deemed to be significant deficiencies by 


their nature. 


The objectives of auditing are not affected by the introduction of computer 
processing, but the different control techniques employed must be taken into 
account by the auditor during his evaluation. In some units the processing 
stage of the EDP system is located off-site, at Supply and Services Canada, or 
at commercial service bureaux or other departments. Except for government- 
wide EDP systems, the audit group is still responsible for evaluating the 
adequacy of the entire control framework, whether it is in-house or located in 
an off-site EDP facility. For government-wide EDP systems operated by 
central service departments, the departmental internal audit group is 
responsible for auditing only those portions of the control framework 
established within its own department. The internal auditors of the service 


department are responsible for evaluating the remaining portions of the 
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framework. The audit of computer-based systems is discussed in detail in 


Appendix A. 
IV The Verification Phase 


In this fourth phase the audit is concentrated on the in-depth verification of 
essential controls, significant deficiencies and major inefficiencies. Since the 
evaluation phase concentrated on the design of the control framework, and the 
review phase provided only limited verification of its operation, the 
conclusions provided to this point are not final. Further verification is 


required: 


- to determine that essential controls are operating as designed and are 


effective; and 


- to substantiate significant deficiencies and major inefficiencies, to 


assess their effect, and to identify their causes. 


Where the verification of essential controls discloses additional significant 
deficiencies or major inefficiencies, these will be subjected to the same 
verification as those originally identified in the evaluation phase. In addition 
to substantiating significant deficiencies and major inefficiencies, the audit 


program should be designed to determine their effect and cause. 


The auditor must clearly define the objectives of each verification step prior 
to developing a comprehensive audit program. These objectives and the nature 
of the policy, system or activity under review will determine the verification 
technique required. The auditor can select from a wide range of techniques in 
developing the audit program, including transaction testing, personal 
observation and enquiry, report and data analysis, independent or third party 
confirmation or interviews, and comparison and analysis of costs or other data 


for similar activities. In developing the audit program the auditor should be 
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alert to conditions where statistical sampling or computer-assisted audit 
techniques can be employed. These techniques can result in more efficient 


and effective auditing. 


Prior to preparing the draft report and recommendations the auditor should 


verify the audit facts with the auditee. 
Vv The Assignment Reporting Phase 


The results of audit work should be promptly communicated, either orally or 
in writing, to appropriate departmental or agency officials as a basis for 
action, where necessary, and for information purposes. Except in very unusual 
circumstances some type of communication should follow every audit 


performed. 
This phase is dealt with in Chapter Eight. 
Interrelationship of Phases of Work 


A close relationship exists between all phases of work performed on an audit 
assignment. The manner and extent to which these phases are carried out and 
the interrelationships between them vary between assignments, depending on 
the objectives established in each case, whether the audit is being made for 
the first time or is a recurring or follow-up assignment, and the significance of 
the activities or programs to be examined. For example, more review work 
would normally be performed on an initial assignment than on one involving 
activities which have been previously reviewed. In the latter cases, some 
updating of general information will be required, but complete new reviews 


should not be necessary. 
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In all assignments, the nature and objectives of the reporting should be 
established as soon as possible and all audit work performed so as to meet 


these requirements adequately and promptly. 


BASIC CONCEPTS 


Due Care 


In executing the procedures discussed in this chapter, it is assumed that the 
auditor performing them will have the technical competence and experience to 
perform the specific audit routines, and the personal qualities of professional 
integrity and objectivity. The Institute of Internal Auditors defines due care 


as follows: 


"Due professional care calls for the application of the care and skill 
expected: of a reasonably prudent and competent internal auditor in the 
same or similar circumstances. Professional care should, therefore, be 
appropriate to the complexities of the audit being performed. In 
exercising due professional care, internal auditors should be alert to the 
possibility of intentional wrongdoing, errors and omissions, inefficiency, 
waste, ineffectiveness, and conflicts of interest. They should also be 
alert to those conditions and activities where irregularities are most 
likely to occur. In addition, they should identify inadequate controls and 
recommend improvements to promote compliance with acceptable 


procedures and practices. 


Due care implies reasonable care and competence, not infallibility or 
extraordinary performance. Due care requires the auditor to conduct 
examinations and verifications to a reasonable extent, but does not 
require detailed audits of all transactions. Accordingly, the internal 
auditor cannot give absolute assurance that non-compliance — or 


irregularities do not exist. Nevertheless, the possibility of material 
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irregularities or non-compliance should be considered whenever the 


internal auditor undertakes an internal auditing assignment. 


When an internal auditor suspects wrongdoing, the appropriate 
authorities within the organization should be informed. The internal 
auditor may recommend whatever investigation is considered necessary 
in the circumstances. Thereafter, the auditor should follow up to see 


that the internal auditing department's responsibilities have been met. 


Exercising due professional care means using reasonable audit skill and 
judgement in performing the audit. To this end, the internal auditor 


should consider: 


the extent of audit work needed to achieve audit objectives; 


- the relative materiality or significance of matters to which audit 


procedures are applied; 


- the adequacy and effectiveness of internal controls; 


- the cost of auditing in relation to potential benefits. 


Due professional care includes evaluating established operating standards 
and determining whether those standards are acceptable and are being 
met. When such standards are vague, authoritative interpretations 
should be sought. If internal auditors are required to interpret or select 
operating standards, they should seek agreement with auditees as to the 


standards needed to measure operating performance." 
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Assignment Management 


Staff engaged in all aspects of an audit assignment should receive adequate 
supervision to ensure that all the standards of audit conduct are maintained 
and that budgets and deadlines are met. Proper supervision also assists in the 
professional development and performance appraisal of the members of the 
audit team. It provides the means whereby each audit can be controlled at 


the planning, execution, and reporting stages. 


To ensure adequate supervision, the organization and implementation of 
supervisory routines must be carefully considered. The organization of the 
audit team should be clearly defined, to ensure that the lines of authority and 
responsibility are understood by each member of the team _ and should 
contribute to the orderly execution of the review process. Larger audit 
groups may have several levels of management within the group. In smaller 
groups the head of the group may perform all managerial, supervisory and 
review tasks. The responsibilities described below will be allocated by each 
group according to its own needs and structure. The term "audit 
management" is employed to denote the whole area of managerial 


responsibility. 


Management will generally supervise and control the technical and adminis- 
trative activities of the staff and undertake to act as primary contact for the 
units being audited. While the audit staff will be responsible for the actual 
execution of the field work in respect of each audit, they should remain in 
regular communication with audit management and discuss changes in plans, 
the progress of the audit, and any problems encountered of a technical or 


administrative nature. 


A review process is necessary to ensure compliance with the plan, proper 
documentation, and execution of specific audit procedures in an appropriate 


and efficient manner. Audit management should complete a detailed review 
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of the audit working papers to evaluate the extent to which the plan achieved 
its stated results and to ensure that the work has been performed in a manner 
which will support the report. The review will result in review notes which 


should be cleared prior to concluding the assignment. 


In all cases the head of the audit group should review the report. He or she 
will have to be satisfied that the plan which was initially approved has been 
implemented, that the audit findings are adequately supported, that all 
working paper review notes have been resolved, and that the experience of the 


current audit has been recorded for planning purposes. 


Therefore, it is Treasury Board policy that: 


14. Every audit assignment should be properly planned. 


15. There should be a sufficient study and evaluation of the operational 
and management systems, procedures, processes and controls as a 
basis for conducting the detailed review and tests required to 


identify and disclose weaknesses and inefficiencies. 


16. Each auditor should exercise due care in the performance of the 


audit. 


17. Sufficient valid and relevant evidence should be obtained and 


documented to support the content of audit reports. 


18. Staff engaged in all phases of an audit assignment should be subject 
to adequate supervision. 


19. All audit work should be subject to a properly planned and 
documented review process conducted by the appropriate level of 


qualified supervisory staff. 
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CHAPTER EIGHT 
REPORTING 


Internal audit reports communicate audit findings to management in order to 
assist it in monitoring the efficiency, economy and effectiveness of its 
internal management practices and controls, in improving the control 
framework, and in ensuring compliance with established policies, plans and 
procedures. The report should supply the manager with the information he or 
she needs, to take or initiate corrective action on any deficiencies reported. 
In Chapter One, "Role of Internal Audit", it is stated that effective monitoring 
of the control process depends on the flow of timely, accurate, concise and 
relevant information to managers, set out so that matters requiring attention 
can be easily seen and acted upon. These same qualities should apply to the 


audit reporting process. 


There are two types of audit report. The first is the assignment report which 
is prepared and distributed to various levels of management as the work is 
performed, or following the conclusion of an assignment. The second is the 
periodic report to the deputy head which summarizes the significant 
observations and provides a conclusion on the integrity of financial and other 
information; the adequacy of controls over public property, revenues and 
expenditures; compliance with objectives, policies, plans, procedures, laws and 
regulations; and the adequacy of internal management practices and controls 
in ensuring the achievement of departmental objectives with the greatest 
possible degree of efficiency, effectiveness, probity and prudence. This 
periodic report does not preclude the receipt of assignment reports by the 


deputy head. 
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AUDIT ASSIGNMENT REPORTS 


Contents 


Each audit assignment must culminate in a written report. This is necessary 
to minimize possible misunderstanding of the auditor's observations and 
recommendations, to provide a record against which corrective action can be 
measured, and to allow the audit results to be easily communicated to all 
officials who.can benefit from the findings. This is in no way intended to 
restrict the discussion of the findings or the oral presentation of the results of 
the audit. 


There is no universal model for the audit assignment report, but the following 


elements are common to all: 


Scope and Objectives 


This section identifies the organization or activity being reported upon. It 
includes a clear statement of the audit objectives, scope, and depth, and 
identifies any limitations in scope, particularly where it might otherwise be 
assumed that audit work took place. The statement may include a comment 
on the methods followed in conducting the audit and may provide explanatory 
information on the organization or activity reported upon, to help the reader 


gain an insight into the areas under examination. 


Summary of Observations and Conclusions 


A summary of the major observations and conclusions should normally be 
presented in the report before the audit observations. In this section, the 
auditor sets down all final conclusions on the adequacy of the various 
components of the area covered by the audit. All conclusions must be clearly 


identified as such, and indicate the basis upon which they were formed. 
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Summarizing findings in this manner is useful in that it highlights the 
deficiencies that require corrective action and attracts the attention of the 
busy executive. However, the auditor must be careful when reporting the 
summarized data or conclusions not to distort the meaning or significance of 
the findings. 


Audit Observations and Recommendations 


In this section the auditor reports specific findings, makes recommendations 
for corrective action and includes comments on the extent and effectiveness 
of corrective action taken on observations and recommendations in preceding 
audit reports. The auditor should convey all findings in an objective and 
informed manner which will motivate management to act upon the 
recommendations. The report should be constructive in tone and should 
concentrate on achieving future improvement rather than emphasizing past 


errors. 


The auditor must conduct sufficient verification and analysis of the deficient 
area during the field-work in order to ensure the identification of a valid 
problem and to determine the various causal factors. This is the starting 
point for an audit observation. In the report, the auditor must set out the 
problem fairly, clearly and concisely and provide pertinent facts so that the 


reader can understand the issue and its significance. 


The report should state the causes of the problem, its financial or other 
implications, and the principles involved. When appropriate it should also 
recommend what action should be taken to resolve the deficiency, giving 
clear indication of the area and level of management responsible for taking 


corrective action. 


All reported observations, data and conclusions must be supported by 


sufficient and appropriate evidence, including details in the report whenever 
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they add to the reader's understanding of the issue. Audit evidence is always 
recorded in the working papers, to support the content of the report. If an 


opinion is expressed, it should be clearly indicated as such. 


Good practices which have been initiated in a specific area and which may 
apply to other areas may be identified during an audit. While the auditor 
would normally comment only on exceptions or problem areas in this section 
of the report, a report on such good practices would be a_ means of 


encouraging implementation throughout the organization. 


Only the more important findings need be included in the written report. 
Other findings can be discussed with the auditee; where corrective action is 
taken during the course of the audit, specific comment need not be made in 
the report. The matters thus dealt with should be documented in the working 


papers. 


Discussion of Audit Findings and Recommendations 


The findings and recommendations should be fully discussed with the officials 
responsible for the activities being commented upon, before the report is 
issued. Where the findings indicate a department-wide problem, they should 
be discussed with the headquarters officials responsible for the function under 
examination. Comments should be obtained from these officials and, where 


appropriate, incorporated into the report. 


This practice allows the auditor to verify the factual content of the report, to 
view the observations and recommendations from the auditee's perspective 
and to obtain a commitment from the responsible officer to take corrective 
action. When agreement cannot be reached the points of disagreement must 


be stated in the report. 
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Distribution of Reports 


The head of the internal audit group should have the right to distribute his 
reports directly to any level in the organization. At the minimum, the report 
should be distributed to the officials directly responsible for taking corrective 
action on the matters raised in it, to their superiors, and to the senior officer 
responsible for the function being audited. The reports should be utilized to 
the fullest extent possible to achieve improvements; senior management 
should therefore be encouraged to send the report, or extracts of it, to 


managers of similar activities. 


SUMMARY REPORTS TO THE DEPUTY HEAD 


The deputy head is responsible for all departmental operations, including 
administrative activities. It is the internal auditor's obligation to assist the 
deputy head in meeting these responsibilities by providing him with annual 
reports; these should either provide assurance that the operations and 
administrative activities are well managed or identify weaknesses in 
management practices and controls and make appropriate recommendations 
regarding the prevention of error and the elimination of conditions that cause 
or contribute to inefficient operations or ineffective results. Although an 
annual report to the deputy head should be mandatory, more frequent 


summary reports may be required at the deputy's discretion. 


These reports should set out the coverage and results of audits, compared with 
the plan submitted to the deputy head. They should summarize the major 
audit findings and recommendations, comment on the extent of management 
follow-up and implementation of corrective action, and provide conclusions on 
the efficiency, economy and effectiveness of internal management practices 


and controls. 
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It should also be emphasized that the head of the internal audit group has a 


responsibility, whenever important audit findings or matters of particular 


sensitivity or urgency come to his or her attention, to ensure that these 


matters are brought to the attention of the deputy head. 


Therefore, it is Treasury Board policy that: 
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A written report shall be issued to appropriate officials of the 
department or agency at the conclusion of every audit assignment. 
The report must be timely, accurate, clearly stated, complete yet 


concise, and recommend corrective action when appropriate. 


A report shall be submitted to the deputy head at least annually on 
audit coverage, major findings, significant unresolved 
recommendations and any other matters requiring the deputy 


head's attention. 


Audit findings and recommendations should be discussed with 
relevant officials prior to issuing the report and their comments 


included in the report, as appropriate. 


The internal audit group should assess whether appropriate 
follow-up action has been taken on the implementation of audit 


recommendations and it should report inadequate action. 
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APPENDIX A 


AUDITING COMPUTER-BASED SYSTEMS 


INTRODUCTION 


Chapter One of this publication stated that the internal audit function can 
provide a highly valuable service to management by reviewing, appraising and 
reporting on all departmental operations, and providing an independent 
assessment to senior management as to the efficiency, economy and effective- 
ness of its internal management policies, practices and controls. Adding 
complexity to such reporting has been the increasing reliance by management 
on computerized information systems for substantial assistance in the 
planning, evaluating and controlling of departmental activities. As the 
computer's -importance to an organization increases, the significance of 
control and management over computer-based systems becomes greater, and 
there is more urgent need for management to be able to seek periodic 


assurance that the controls in force are adequate. 


With the advent of computerized systems, there has been an increasing 
emphasis on the use of information as an integral part of the management 
process. At the same time, managers have been required to address the 


management of data processing installations and support services. 


The auditor therefore must adapt his approach to this new environment. 
Specifically, he must address the new approaches to the processing of 
information and the effects of it on the delivery of programs or services, the 
monitoring of performance and the managing of the entity. As well, he must 
review and comment on management control of the data processing facilities 


and staff. 
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To clarify the auditor's role, the following matrix defines the areas of audit 


activity which an auditor would address in carrying out his work. The 


activities are categorized under the auditor's responsibilities to review and 


comment on controls, economy, efficiency and effectiveness. 


Control Economy Efficiency 
EDP Facilities Computer Facilities Facilities 
Centre Acquisition Utilization 
Controls 
Information Systems Application Systems Application 
Integrity Development Systems 
Controls Performance 


The areas of audit activity are defined as follows: 


Computer Centre Controls 


Investigation and appraisal of the operational controls existing within an 


EDP facility, with particular attention to security and reliability of data 


processing services and records. 


Application Integrity Controls 


Investigation and appraisal of the controls existing in a particular 
information system to ensure completeness and accuracy of information, 
proper authorization of transactions, compliance with stated accounting 


policies, and the adequacy of procedures for retention of records and 


transaction trails. 


Operational — 
Effectiveness 


Facilities 


Services 


Information 
Requirements 
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Facilities Acquisition 


Investigation and appraisal of the procedures used when acquiring 
facilities to establish the need, investigate the alternatives, and justify 
the choice and the procedures used to control the acquisition and 


implementation activities. 


Systems Development 


Investigation and appraisal of the procedures used when developing new 
information systems to determine the scope for the system, evaluate the 
alternatives, and justify the choice and the procedures used to control 


the acquisition, development and implementation of such applications. 
Facilities Utilization 


Investigation and appraisal of the manner in which facility workload 
measurements are performed and the measures of productivity and 


performance that are applied. 


Applications Systems Performance 


Investigation and appraisal of the manner in which a particular 
information system affects the clerical and administrative procedures 


required and the resulting impact on performance and productivity. 
Facilities Services 


Investigation and appraisal of the procedures leading to the choice of 
the types of data processing services made available centrally or 
remotely and the method by which these choices are ranked and 


reviewed. 
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Information Requirements 


Investigation and appraisal of the procedures leading to the choice of 
the key information systems to be developed and the method by which 


these choices are ranked and reviewed. 


By conducting audit activity in these areas the auditor will comply with the 
audit standards relating to scope described in Chapter Two of this publication. 


This appendix describes in further detail those audit activities. 


Further guidance in this area can be obtained from the following sources: 
Administrative Policy Manual, Chapter 440 - Electronic Data Processing, 
(Treasury Board, 1978); Computer Audit Guidelines, (CICA, 1975); Computer 
Control Guidelines (CICA, 1978); L'audit informatique (Claude Saint-Antonin, 
Masson, 1976); and Guide on Financial Administration (OCG, 1979). 


CONTROL 


When carrying out the audit of any process, data processing controls, like 
any other control, must be considered. As mentioned in the introduction, 


EDP controls do add an increased dimension to the review. 


There are two primary areas of control in an EDP environment: the 
first is the physical or environmental controls which concern the 
computer centre itself. These are often referred to as general controls 
and, for the purpose of this publication, are defined as the controls 
normally applicable to all processing being carried out in any given 
installation. These are examined under the computer centre audit 
activity. The second area is the application integrity controls which are 
a requirement in the design of any given system. These two areas are 
discussed in more detail below. As mentioned in the introduction, there 
are numerous publications available to assist the auditor in the review of 


controls for computer-based systems. 
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Computer Centre Controls 


To ensure accurate processing and adequate protection of data and 
computer programs, management must establish effective controls over 
its computer centres. The auditor must review these operational 
controls with particular attention to security and reliability of data 


processing service and records. 
The auditor's examination will include reviews of the following areas: 


- Organization structures, with particular emphasis on the 


segregation of incompatible functions. 


- Operating procedures, including supervision of operators, 
monitoring of their activities, scheduling of processing and 


adequacy of operating instructions. 


~ Security, including physical security and controls, either 


physical or software, over access to programs and data. 


- Data control activities, including control over input and 


distribution of reports. 


- Backup for programs, data and hardware including 


appropriate disaster planning. 


Many departments and agencies process their data at centres outside 
their direct control, either within government or in the private sector. 
It is impractical for all auditors using these centres to conduct audits of 
them. The auditor should obtain reports on the controls in the private 


sector centres. 
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These are often referred to as third-party reviews. Such reports are 
normally available from the data centre management. For government 
centres, enquiries should be directed to the auditors of the department 


involved. 


Chapter 440, Section 8 of the Treasury Board Administrative Policy 
Manual defines the responsibilities of management as regards EDP 
Security. The RCMP Security Evaluation and Investigation Team carries 
out security audits on centres where government data are processed. 
The auditor should review copies of these reports where applicable to 
obtain information on the security of the centre and to minimize overlap 


of audit activity. 


Application Integrity Controls 


This activity includes the evaluation of the processing controls in a 
specific information system. Processing controls ensure’ the 
completeness and accuracy of information, proper authorization of 
transactions, compliance with stated accounting and_ legislative 
requirements and the adequacy of procedures for retention of records 


and audit trails. 


The effective operation of controls in a specific application system is 
reliant on an effectively controlled data centre activity. When 
examining an application system that is in operation, it is therefore 
important that the auditor schedule data centre audits in conjunction 


with a control audit. 


The control audit will normally include the documentation of the system 
and its controls, the evaluation of the controls, and the testing of the 
effective operation of the controls. Other aspects to be included are 
dealt with below. 
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The testing of systems will normally include examination of 
documentation which supports selected transactions, testing of 
calculations, and compliance with control procedures. Tests may include 
examination of data held in machine-readable form through the use of 
computer-audit software or test data. In some cases computer programs 
will be examined to ensure compliance with legislative or other 


requirements. 


Application systems will be examined periodically to ensure continued 
operation of the controls and to examine changes made in the programs 


and supporting procedures. 


The auditor should examine the controls in systems prior to 
implementation. Changes can be made more easily at this time and the 
examination by the auditor helps management in the control of the 


system-development process. 


Other concerns to be addressed by the auditor during his review of a 


system either in place or under development include the following: 


- management policies and reporting requirements are included in 


the system (see section on Information Requirement Audit); 


- adequate audit trails exist, i.e. transactions can be traced from 


input to the final reports, or at least can be recreated, if needed; 


- all legislative requirements have been incorporated in the systems 


design; and 


- the system is adequately documented for purposes of maintenance, 


audit and protection against disruption of operation. 
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The auditor will report to management weaknesses discovered by his 
audit. In the case of reviews prior to implementation, he may be 
required to indicate his satisfaction with controls and audit trails before 


implementation. 


In summary, a control audit should be conducted during the development 
of a system. In subsequent years the audit activity will focus on changes 


to the system and ensuring that controls continue to operate. 


It is recognized that the auditor is often faced with systems already in 


place and must conduct his audit of controls on that basis. 
ECONOMY 


Determining whether an organization is managing and utilizing its 
resources in an economical manner is an integral part of the audit as set 
forth in Chapter Seven of this publication. With the development and/or 
maintenance of complex computer-based systems, the internal auditor's 
review should demonstrate that operations will produce desired results at 


minimum cost. 


The two key areas affecting economy are the acquisition of facilities and 
the systems development activity. The review of these areas is 
discussed below. Obviously the review of these areas is best carried out 
during the development phase of any system. When conducting a review 
on a_ post-implementation basis, the auditor should review the 


development aspects as well as the current operations of the system. 


Facilities Acquisition 


The process of acquiring computer-processing resources requires a series 


of defined and disciplined steps in order to ensure that the preliminary 
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Studies are complete and accurate and form a sound basis for 
management decision. The uneconomic use of EDP resources is a 
management concern. The auditor should determine that the most cost- 
effective and appropriate approach has been taken in the establishment 
of hardware and purchased software requirements. 


Chapter 440, Section 3 of the Treasury Board Administrative Policy 
Manual provides directives and guidelines for departments and agencies 


for the acquisition of computer resources. 


The auditor will examine the procedures carried out by the audited 
entity and assess compliance with generally accepted management 
practices for this activity as well as any Treasury Board directives and 


guidelines. 


Systems Development 


The auditor must ensure that proper feasibility studies are being or have 
been carried out prior to the design and development of systems, 
including major maintenance projects. This primarily consists of 
ensuring that adequate attention has been given to the determination of 
scope, evaluation of the various alternatives available and the 


justification for the resultant choice. 


A good system of project management must also be in place. This 
control system must allow management to reassess feasibility at various 


key control points during development. 


Again, as in the facilities acquisition function, Chapter 440, Section 3 of 
the Treasury Board Administrative Policy Manual provides directives and 
guidelines to be followed in the development of EDP projects. The 
auditor will examine compliance with generally accepted management 


practices and Treasury Board policy. 
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EFFICIENCY 


The efficiency of any operation depends on how well resources are used 
to produce an end product. In any computer-based system, the data 
processing resource, be it people or machines, must be considered. ‘The 
computer is merely a means to the end and as such must be looked at in 


the same manner as any other resource. 


The efficiency of the data processing activity is examined at two levels; 
the efficiency of the data centre operations, that is, hardware, operating 
software and support activities; and the application software. The 
efficiency of the data centre operations is the focus of the facilities 
utilization activity. This includes an examination of the application 
software from the point of view of optimizing its efficiency through an 
efficient code. The application systems performance audit described 
below deals with the design of the interface with the users of the system 


rather than the internal code efficiency. 
Facilities Utilization 


Chapter 440, Section6 of the Treasury Board Administrative Policy 
Manual provides directives and guidelines on computer performance 
improvement. Each department or agency is directed to monitor the 
performance of its installations and report to Treasury Board on 


performance and utilization. 


The auditor will examine the methods of monitoring performance used by 
the audited entity and comment on their applicability when appropriate. 
Compliance with Treasury Board requirements will be examined and the 


accuracy of reporting confirmed. 


ey / es 


Application Systems Performance 


In carrying out his or her audit activity, the auditor has the opportunity 
to examine a wide range of application systems. It may become 
apparent that certain activities are not being carried out in the most 


efficient manner. For example: 
- manual activities that could be computerized; 


- batch systems that might be more efficient if presented in an on- 


line mode; 


- systems that are difficult for the users to deal with (e.g. 


cumbersome input forms, output difficult to work with); and 
- lack of communication between data processing and users. 


The auditor may examine these matters further through an audit to 
attempt to determine the reasons for the inefficiency. This would 
involve discussions with users, data processors and management 


personnel. 


It is not the auditor's role to recommend specific solutions but rather to 
point out to management apparent inefficiencies in their application 


systems. 
OPERATIONAL EFFECTIVENESS 


Auditors must concern themselves with operational effectiveness 
regardless of whether the process is manual or computer-based. From 
an EDP facilities viewpoint this involves an examination of the 


effectiveness of the data centre in providing data processing services, as 


AOR 


well as the effectiveness of information systems in providing information 


for the management of a program or activity. 
Facilities Services 


A facilities services audit examines the effectiveness of the approach 
used in providing data processing services. The information require- 
ments audit examines the effectiveness of the information provided. 


The information requirements activity is described in the next section. 
The major areas of audit investigation in a facilities services audit are: 


- the choice of operating systems and sub-systems services as they 


relate to the requirements of the auditee organization; 


- the degree to which systems should be centralized or distributed; 


and 


~ the range of flexibility of turnaround and responsiveness available 


to system designers. 


This type of audit requires a high degree of technical computer skill. 
The findings are likely to be of a nature which management might 


challenge as they are likely to reflect radically different options. 


An audit of this nature would only be undertaken where there was an 
obvious lack of management planning and control of EDP activities. The 
auditor's role is limited to indicating to management that other options 
should be or should have been examined and not to make specific 


recommendations. 
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Information Requirements 


To effectively manage a government program, current and relevant 
information must be made available. Traditionally, auditors have 
concerned themselves predominantly with the completeness and 
accuracy of data and not necessarily with its relevance or usefulness as 


a management tool. 


Program evaluators may find that a government program is not meeting 
its objectives. One factor in this may be a lack of current and relevant 
data for use by management. The auditor should therefore confer with 
the program evaluator to determine whether an audit of this nature 


would be appropriate. 


It is possible that an auditor may discover during the course of other 
audit activity that information available to a manager is not adequate 
(e.g. inadequate analysis of expenditure for a financial administrative 
function). An audit could be carried out and the inadequacy brought to 
the attention of management. An integral part of this examination 
would be a review of the procedures utilized by the entity to determine 


the practices for systems to be developed. 
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APPENDIX B 


TERMS OF REFERENCE 


INTERDEPARTMENTAL ADVISORY COMMITTEE 
ON INTERNAL AUDIT 


The primary purpose of the committee is to improve the efficiency and 
effectiveness of departmental and agency internal audit in the Government of 


Canada. 


The committee will meet periodically to consider audit problems advanced by 
any departmental unit, provided that the problems involved are generic in 
nature and amenable to resolution on a mutual basis, or items proposed by 
central agencies. The committee will serve as a means of bringing together 
persons who can work out solutions through discussion. It is expected that the 
conclusions of the committee will be of benefit to departmental audit groups, 
the Office of the Comptroller General, the Treasury Board Secretariat, and 
others, as appropriate. The committeee will have no decision-making 
authority to bind the departments and agencies represented, however, all 
members will be expected to actively support a policy of cooperation and 


coordination. 

OBJECTIVES 

The committee shall have the following objectives: 

a) to provide a forum where the senior auditors from departments and 


agencies of the federal government can exchange views and solve 


common problems related to internal audit; 


b) 


c) 


d) 


e) 


f) 
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to consult with the Office of the Comptroller General (OCG) during 
development of policies, standards, and methodologies for internal audit 


in departments and agencies of the Government of Canada; 


to promote the acceptance, uniform interpretation, and implementation 


of such audit standards within the departments and agencies; 
to keep audit standards current by proposing needed changes to the OCG; 


to identify the training and development needs of all levels of the 
government internal audit community and to promote and participate in 
programs of professional development for government internal auditors; 


and 


to coordinate the development and distribution of standard audit 
programs and related information, in order to minimize duplication of 


research and development efforts. 


ACTIVITIES 


To further its objectives, the committee 


a) 


b) 


shall hold general meetings, work through technical working committees, 


and sponsor technical group discussions; 


may develop and formally promulgate position papers or take such other 


action as may be appropriate with respect to: 
(1) | maintenance and interpretation of the audit standards, 


(2) standardization of audit guides, 
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(3) specific interdepartmental audit problems and how best to resolve 
them; 


c) shall provide a means of communication between the committee, 
professional organizations, central agencies and others who, from time 
to time, may become directly involved with activities addressed by the 
committee; and 


d) shall provide a means whereby all members of the government internal 
audit community can have access to, and share in the knowledge, 


information and experience of, fellow members of the community. 
MEMBERSHIP 
The committee shall consist of: 

(1) all heads of Internal Audit; 


(2) heads of Evaluation/Audit of central agencies and departments 
With functional responsibility for specific policies having 


government-wide application, and 


(3) Assistant Comptroller General, Internal Audit and Special Studies 


Division, along with key staff. 


The Assistant Comptroller General will be Chairman and a member of his staff 


will be secretary to the committee. 


A Steering Committee of ten members will meet regularly to provide ongoing 
guidance for the technical working committees, determine the need for and 
administer technical group discussions, and convene and administer periodic 


general meetings. The Steering Committee shall consist of two permanent 


S04: 


members and eight rotating members selected from the general membership 
for a two-year period. The permanent members will be the ACG as chairman 


and a member of his staff as secretary. 


MEETINGS 


(1) Periodic general meetings will be held as determined by the Steering 


Committee (minimum of twice a year). 


(2) Technical group discussions will be convened by the Steering Committee 


as it sees fit. 


(3) Technical working group meetings will be organized and run under their 
own chairman and will meet as the members see fit (minimum once a 


month). 


(4) The Steering Committee will meet once every two months unless an 


urgent need arises for more frequent meetings. 
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GLOSSARY 


ACCOUNTABILITY/IMPUTABILITE, OBLIGATION DE RENDRE COMPTE 


Means, in its simplest terms, the obligation to answer for a responsibility 
that has been conferred. It presumes the existence of at least two 
parties: one who allocates responsibility and one who accepts it with the 


undertaking to report upon the manner in which it has been discharged. 


ACTIVITIES/ACTIVITES 


Alternative or complementary means of achieving an objective or set of 
objectives of a program. The term is also used to refer to the highest 
level of activity classification or first division of a program, normally 


that used in Estimates submissions to Parliament. (see also Program) 


ADMINISTRATION/ADMINISTRATION 


Sometimes referred to as the federal administration; both are used 


synonymously to mean the Government of Canada. 


ADMINISTRATIVE CONTROL/CONTROLE ADMINISTRATIF 


Comprises the plan of organization and the procedures and records 
concerned with the decision processes that lead management to 
authorize transactions. Such authorization is a management function 
directly associated with the responsibility of achieving the objectives of 
the organization and is the starting point for establishing control of 


transactions. 
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AGENCY/ORGANISME 


A term used in the federal government to mean any legal entity which is 
not a department or a Crown corporation. The term should not be 


confused with an Agency corporation. 
ANALYSIS/ANAL YSE 


The methodical investigation of a problem by resolving it into its simple 


components. 


ANALYTICAL AUDIT (SYSTEMS-BASED 
AUDITING)/VERIFICATION ANALY TIQUE 


An auditing technique based upon appraisal of an organization's systems 
and internal control, characterized by the use of flow charts, and limited 
but in-depth testing of transactions to determine the satisfactory 


operation of the system. 
AUDIT, V./VERIFIER 


To examine evidential material to determine the reliability of a record 


or an assertion. 
AUDIT, N./VERIFICATION 
A systematic appraisal activity that examines the policies, practices, 


records and activities of an organization in order to determine their 


adequacy in relation to a predetermined standard. 
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AUDIT ASSIGNMENT/TACHE DE VERIFICATION 


A manageable audit unit for which time and resources have been allotted 
and for which responsibility has been, or is about to be, assigned in terms 
of specific scope and objectives. 


AUDIT COMMITTEE/COMITE DE VERIFICATION 


A departmental committee which is normally constituted of the deputy 
head as chairman and executives whose attributes assure the provision of 


sound-and objective counsel to the deputy head. 


AUDIT FINDING/CONSTATATION 


Findings resulting from the comparison of an existing system, control, 
practice, etc. with relevant audit criteria. An evaluation of findings 


results in conclusions and recommendations. 


AUDIT PROGRAM/PROGRAMME DE VERIFICATION 


A detailed listing of the nature and extent of procedures to be carried 


out in a particular audit engagement. 


AUDIT STANDARDS/NORMES DE VERIFICATION 


Criteria against which the appropriateness of auditing procedures is 
considered in relation to the objectives to be attained, the quality and 
extent of their application, and the suitability of the resulting audit 


report. 
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AUDITEE/ENTITE VERIFIEE 
The entity subject to audit. 
BUDGET/BUDGET 


A detailed estimate of future transactions, either in terms of quantities, 
or money values, or both, designed to provide a plan for and control over 


future operations and activities. 
COMPTROLLER GENERAL/CONTROLEUR GENERAL 


The Office of the Comptroller General was created in 1978 by an 
amendment to the Financial Administration Act. The Office is headed 
by the Comptroller General of Canada who reports directly to the 


President of the Treasury Board. 
CONTROL/CONTROLE 


The process by which the activities of an organization are conformed to 
a desired plan of action and the plan is conformed to the organization's 


activities. 


The established process that enables management to direct and monitor 
its activities, including: the framework for control, including objectives, 
plans and standards; the delegation of the authority to act on them; the 
continuous monitoring and evaluation, to identify deviation from the 
framework; and corrective action to restore operations to the prescribed 


framework, where necessary. 
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COSTS/COOTS 


Measures of resources consumed during a period of time, without regard 


to when ordered, delivered or paid. 


DELEGATION OF AUTHORITY/DELEGATION DE POUVOIR 


The authorization given by one person to another to reach decisions and 
take actions within a defined sphere of responsibility, subject to 
accountability. The delegation cannot relieve the delegator of the 


responsibility or accountability for those decisions and actions. 


DEPARTMENT/MINISTERE 


A department means: any of the departments named in Schedule A of 
the Financial Administration Act; any other division or branch of the 
Public Service of Canada, including a commission appointed under the 
Inquiries Act, designated by the Governor in Council as a department for 
the purposes of this Act; the staffs of the Senate, the House of Commons 
and the Library of Parliament, and any corporation named in Schedule B 


of the Financial Administration Act. - 


DEPUTY HEAD/SOUS-CHEF 


The non-elected head of a department. It includes deputy ministers, 


chairmen, presidents or other chief executive officers. 


DISTRIBUTED PROCESSING SYSTEM/UNITE CENTRALE REPARTIE 


An arrangement of computers within an organization that has several 
separate computer facility locations. The computers are interconnected 
to work in a cooperative manner rather than as conventional single- 


location facilities. 
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DUE CARE/DILIGENCE, CONSCIENCE PROFESSIONNELLE 


A professional obligation to execute every responsibility with the care 
expected of a reasonable man with the same or similar qualifications in 


similar circumstances. 


ECONOMY/ECONOMIE 


Economy refers to the terms and conditions under which the government 
acquires human and materiel resources. An economical operation 
acquires those resources in appropriate quality and quantity at the 


lowest cost. 
EDP (ELECTRONIC DATA PROCESSING)/INFORMATIQUE 


Processing which involves the use of general purpose digital computers 
and of auxiliary equipment operating in support of computers (including 


electro-mechanical unit record equipment). 
EDP FACILITIES/FACILITES INFORMATIQUES 


The term used to encompass a set of computers in an audit entity and 
any service bureau being used, and also the in-house staff involved in 
planning for and operating those computers and providing executive 


software. 
EFFICIENC Y/EFFICIENCE 


Efficiency refers to the relationship between goods or services produced 
and resources used to produce them. An efficient operation produces the 
maximum output of a specified quality or characteristic for any given 
set of resource inputs or it has minimum inputs for any given quantity 


and quality of service provided. 


- lll - 


ENVIRONMENT CONTROL/CONTROLE DU CADRE D'EXPLOITATION 


A control which operates externally to a manual or mechanical system 
but which has an effect on that system because of its general, pervasive 
nature. 


ESSENTIAL CONTROL/CONTROLE ESSENTIEL 


One of the controls which is vital to the effective operation of a system, 


and without which material error could occur and remain undetected. 


EVIDENCE/PREUVE 


The information collected and used by the auditor to arrive at an 


assessment of whether audit criteria are being met. 


EXTERNAL AUDITOR/VERIFICATEUR EXTERNE 


An auditor, not an employee or an agent of the organization subject to 
review, normally engaged in the conduct of a statutory audit or an audit 


pursuant to an agreement. 


FLOW CHART/GRAPHIQUE D'ACHEMINEMENT 


A graphic presentation of the movement of goods, documents or work, 


especially related to the operations of an organization. 
FRAUD/FRAUDE 
Refers to acts committed with an intent to deceive, involving 


misappropriation of assets or intentional misrepresentations of financial 


information, either to conceal misappropriations of assets or for other 
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purposes, by such means as: manipulation, falsification or alteration of 
records or documents; suppression of information from records or 
documents; recording of transactions without substance; and 


misapplication of accounting principles. 


GOAL/BUT 


A projected level of achievement at specific future points in time in an 
area of recognized responsibility. A goal involves the translation of 
objectives into shorter-range tasks, which are time-phased, possibly 


quantifiable and attainable. 


GUIDELINE/LIGNES DIRECTRICES 


A statement indicating an instruction which, while not mandatory, should 
be followed unless there is good reason not to do so. While valid reasons 
for non-compliance must be documented, prior Treasury Board approval 
is not required. Guidelines are characterized by the use of the word 
"should". 


HARDWARE/MATERIEL 


The physical equipment or devices forming a computer and peripheral 
equipment. (Compare SOFTWARE) 


INDEPENDENCE/INDEPENDANCE 


The characteristic of the relationship between the auditor and auditee 
that ensures that the auditor's conclusions and reports will be influenced 
only by the evidence obtained in accordance with the rules and principles 


of professional discipline. 
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INTERNAL AUDIT/VERIFICATION INTERNE 


Internal audit is the systematic, independent review and appraisal of all 
departmental operations for purposes of advising management as to the 
efficiency, economy and effectiveness of the internal management 


policies, practices and controls. 
INTERNAL CONTROL/CONTROLE INTERNE 


The plan of organization and all the coordinated methods and measures 
adopted by management to safeguard assets, ensure the accuracy and 
reliability of accounting data, promote operational efficiency and 


maintain adherence to prescribed policies. 
INVESTIGA TION/ENQUETE 


A special examination conducted for a particular purpose. It may be 
more or less extensive than the regular annual audit. Examples are: an 
examination of operating results over a term of years for a prospective 
purchase or in connection with the issue of securities, and an 


examination of books, vouchers, etc., in connection with fraud. 
LEGISLATION/LOI 


Statutes adopted by Parliament in the exercise of its legislative powers 
are originally introduced as bills and may originate in the House of 
Commons or Senate. All bills must be read three separate times in each 
House, be adopted by both Houses, and receive Royal Assent in order to 
become law. Some laws are in force upon Royal Assent. Others must be 
proclaimed in force by Order in Council. All proclamations appear in 
Part I of the Canada Gazette. 


Saas 


MANAGEABLE AUDIT UNIT/UNITE DE VERIFICATION MANIABLE 


A potential audit assignment of such size, scope and nature that, if 
audited with due care, will produce significant and meaningful 
information for management and will permit effective planning, 


controlling and execution of all audit work. 


MANAGEMENT CONTROL/CONTROLE DE GESTION 


Management control is the process by which management ensures that 
the organization carries out its strategies effectively and efficiently. A 
good system of management control would include: a statement of the 
objectives of the entity; a plan of organization for accomplishing the 
objectives; personnel of a quality and quantity commensurate with their 
responsibilities, with adequately segregated functions; an established 
system of appropriate policies and practices for each unit or program; 
and an effective system of review at all levels of activity to ensure that 
the established system of appropriate policies and practices is carried 


out. 

MANAGEMENT PROCESS/PROCESSUS DE GESTION 
A part of the management system comprising a logical series of linear 
relationships of essential activities and their associated procedures 
pertaining to the management of resources or concerning operational 
effectiveness. 


MANDATE/MANDAT 


Authority to perform a task or attain a goal. 
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OBJECTIVE/OBJECTIF 


A desired state to be reached or maintained through one or more 


activities. (See also Goal) 


OBJECTIVITY /OBJECTIVITE 


The ability to express, or involve the use of, facts without distortion by 


personal feelings or prejudice. 


ON-LINE/EN DIRECT 


Equipment, devices or files that are electronically connected to the 


computer for purposes of access. 


OPERATIONAL EFFECTIVENESS/EFFICACITE DE L'OPERATION 


The extent to which operations achieve their objectives or goals. 


(Compare with Program Effectiveness) 


PERFORMANCE MEASUREMENT/MESURE DE LA PERFORMANCE 


A term used to describe a manager's routine measurement of the ongoing 
performance of program operations in terms of the economy with which 
resources are acquired, the efficiency with which operations are 
conducted, the quality of the product or services provided and the extent 
to which operational objectives are achieved. Measurement can involve 
trends and comparisons of indicators or other performance information 


on a program's activities. 
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PLANNING/PLANIFICA TION 


The process of determining in advance what outputs will be produced, 
the specifications and quantity of each output, the means by which such 
outputs will be produced and the identification of related resources; may 


be identified as long-range, program or operational planning. 
POLICIES/POLITIQUES 


General statements of desired behaviour for an organization. They guide 
thinking and decision-making within the framework of present or future 
resources. Policies tend to limit the scope or area within which 
decisions must be taken and ensure that necessary decisions contribute 


to the accomplishment of objectives. 
PREVENTIVE CONTROLS/CONTROLES PREVENTIFS 


Preventive controls in the system are set up to detect unauthorized or 


erroneous input as early as possible in the processing cycle. 
PRINCIPLES/PRINCIPES 

A comprehensive and fundamental law, doctrine or assumption. 
PROCEDURES/PROCEDURES 

Procedures are more specific than policies and provide definitive and 

definite responses in the handling of current work. Essentially, they lay 


down the chronological (rational or logical) sequence of steps to be taken 


to achieve either a global or a limited objective. 
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PROGRAM/PROGRAMME 


A group of related departmental activities designed to achieve specific 


objectives authorized by Parliament. 
PROGRAM EFFECTIVENESS/EFFICACITE DU PROGRAMME 


Program effectiveness concerns the extent to which a program achieves 
its goals or other intended effects. For example, to increase income in a 
particular area, a program might be devised to create jobs. The jobs 
created would be program output. This contributes to the desired 
program effect of increased income which can be measured to assess 
program effectiveness. Of course, not all programs are equally 
evaluable. Also, management procedures for measuring and reporting 
effectiveness will differ between programs. (See Operational 


Effectiveness) 
PROGRAM EVALUATION/EVALUATION DE PROGRAMMES 


The periodic, independent and objective review and assessment of a 
program to determine, in the light of present circumstances, the 
adequacy of its objectives, its design and its results, both intended and 
unintended. Evaluations will call into question the very existence of the 
program. Matters such as the rationale for the program, its impact on 
the public, and its cost-effectiveness as compared with alternative 
means of program delivery are reviewed. In this context, a ‘program! is a 
major activity or group of activities designed to achieve specific long- 


term objectives of an organization. 
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RESPONSIBILITY CENTRE/CENTRE DE RESPONSABILITE 


An organizational unit in which the manager has been delegated 
authority to manage financial resources, including responsibility for 
determining financial requirements, controlling costs in relation to 
operational accomplishment, and exercising spending authority to 


approve charges against his budget. 
SAMPLING, N./ECHANTILLONAGE 


The examination of a selection of items from a larger number of similar 
items, with the objective of judging the quality of the whole on the basis 
of the sample. 


SOFTWARE/LOGICIEL 


All programs, procedures and rules, and ultimately the associated 
documentation relating to’ the operation of a computer. (Compare 
HARDWARE) 


STANDARD/NORME 


The desired performance against which actual performance can be 


evaluated. 
STATE OF THE ART/CONDITIONS IDEALES 


The best available techniques, methodology, data, experience, with 
respect to policy planning, efficiency measurement, formative research, 
evaluation research or program effectiveness evaluation. The practical 
level to which any branch of professional skill or knowledge has been 


developed at a particular time. 
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STATISTICAL SAMPLING/ECHANTILLONAGE STATISTIQUE 


Sampling in which the extent and interpretation is determined by the 


scientific application of mathematical probabilities. 
STATUTORY AUDIT/VERIFICATION REGLEMENTAIRE, LEGALE 


A type of external audit carried out in accordance with the provisions of 
a statute, such as corporation acts, The Bank Act, the Auditor General 


Act, the Income Tax Act or the Excise Act. 
SYSTEM/SYSTEME 


A set of connected things or parts, united by some form of regular 


interaction or interdependence; an organic or organized whole. 
SYSTEMS-BASED AUDITING/VERIFICATION BASEE SUR LES SYSTEMES 


In systems-based auditing, the nature, extent and timing of detailed 
audit procedures are based on the organized study and assessment of the 
significant systems and controls in the audited organization. This study 
and assessment carried out in the initial phase of the audit determines 
which systems are important to the management of the audited 
organization and the extent to which testing during the execution phase 
of the audit is required to assess the reliability of controls and of reports 


to Parliament. 


The systems-based approach is designed to enable the auditor to 
concentrate the audit effort in areas where performance is not 
adequately monitored and disclosed and where controls either do not 
exist or are not operating properly. At the conclusion of the 


examination, the auditor should be in a position to point out the 
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strengths and weaknesses of the key systems and related controls and to 
indicate causes and effects of the weaknesses and develop conclusions 


and recommendations. 
TEST/SONDAGE (MISE A L'EPREUVE) 
The application of a given audit procedure to some items within a group. 
WORKING PAPERS/FEUILLES DE TRAVAIL, DOSSIERS DE VERIFICATION 
Schedules, transcripts, analyses, confirmations, notes and _ other 


memoranda proposed and accumulated by an accountant or auditor in the 


performance of his duties. 
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